In a post on X, @ZixuanLi_ says ZCode is now open source and that the reported security issues have been addressed. The post also says independent security reviews by third-party firms are underway, with findings to be shared later. That makes the announcement both an open-source release and a security-status update—but it does not provide the review results or independently establish that every reported issue has been resolved.

The ZCode repository on GitHub describes the project as an AI coding workspace with a desktop application, a browser interface and a terminal-based Agent. It includes client applications, backend services, shared user-interface code, and the source for the Agent command-line interface and runtime.

What ZCode includes

The repository presents three ways to use or develop ZCode:

  • Desktop: An Electron application, with its main process, host, renderer and packaging code under packages/desktop.

  • Web: A browser-based workspace supported by the Web client and backend services.

  • Agent CLI: A terminal interface and runtime that can also provide the Agent functionality used by the desktop and Web modes.

The repository’s structure reflects those roles. packages/web contains the Web client, while packages/server provides HTTP, WebSocket and remote-connection services. Shared React components, hooks and Zustand state are in packages/ui; common protocols, RPC code and client SDKs are grouped under shared packages. The Agent CLI, terminal user interface (TUI), runtime and tools are in apps/zcode-cli.

This organization means the interfaces are not presented as three unrelated products. The repository describes the Agent CLI and runtime as a component used directly from the terminal and as the Agent runtime for the desktop and Web experiences.

How the desktop, Web and terminal modes differ

The desktop development entry point is:

pnpm dev:desktop

The repository identifies this mode as an Electron desktop application. Its development script prepares local runtime resources, builds the desktop Agent and starts Electron with source watching. A test configuration is also listed as pnpm dev:desktop:test.

The Web development entry point is:

pnpm dev:web

According to the repository instructions, this starts a Web development server and a local backend. The default development addresses are http://localhost:5173 for the Web server and http://localhost:3030 for the backend. A ZCODE_SERVER_WORKSPACE environment variable can be used to specify the backend’s workspace path.

The repository also describes a unified zcode command-line package containing the TUI, Web interface and Agent. In that packaged mode, the commands are divided by their arguments:

zcode          # Open the terminal interface
zcode --web    # Start the Web interface

The two modes run locally without Electron. The Web mode can accept options such as a workspace path, a port and --no-open to prevent automatic browser launching:

zcode --web --workspace /path/to/project --port 3030 --no-open

The repository says the Web mode listens on 127.0.0.1 by default, uses the current directory as its default workspace and automatically selects an available port. It also documents options for exposing the service beyond the local machine, specifying a token or disabling token authentication. These are repository-documented runtime behaviors, not evidence that the application is secure in every deployment configuration.

What developers need before exploring the repository

The repository lists Git, Node.js 24.14.0 and pnpm 10.33.2 as development prerequisites, with versions defined by mise.toml. Its main initialization command is:

pnpm bootstrap

The project says this installs workspace dependencies, prepares local desktop runtime resources and runs the bootstrap build. The Agent CLI and runtime are included directly in apps/zcode-cli; developers do not need to fetch them as a separate Git submodule.

Other documented commands include:

pnpm install
pnpm build
pnpm --filter @zcode/cli dev
pnpm --filter @zcode/cli... build

pnpm install installs dependencies, while pnpm build builds workspace packages. The latter two commands are for directly developing or building the CLI and its workspace dependencies. These are instructions from the repository, not steps tested for this article, so developers should consult the current files and configuration before relying on them in a development or deployment environment.

The repository also separates development from release packaging. Desktop builds use pnpm bundle:desktop, while the combined command-line distribution uses pnpm build:zcode. The latter assembles the CLI/TUI, backend and Web components into a distribution package, and the repository says that running the packaged version still requires Node.js.

What is known about the reported security issues

The supplied announcement says the reported security issues have been addressed and describes an investigation and remediation process involving the ZCode team. It also says independent reviews by third-party firms are underway.

The announcement does not identify the reported vulnerabilities, describe their impact, name the firms conducting the reviews or provide a review timeline. It also does not include independent findings or test results confirming the scope of the fixes. The repository’s public availability should therefore not be treated as proof that the reported issues were fixed, or as a general security assessment of ZCode.

The repository does document authentication-related configuration for some Web deployments. For example, it says that a Web mode exposed beyond the local machine can use an access token, and that the general HTTP/WebSocket server can be configured with ZCODE_SERVER_AUTH_TOKEN. It also documents a default local mode without an access token. Those details matter when evaluating how a developer might run the software, but they do not answer whether the reported issues were related to authentication or whether the implementation is safe for a particular environment.

What readers can verify now

The repository gives developers a concrete map of the project: Electron desktop code, a browser workspace, backend and remote-connection services, shared UI and protocols, and the Agent CLI and runtime. It also gives them documented development commands and configuration variables to inspect.

What remains unresolved is the security status beyond the announcement. Until the promised third-party findings are released, readers cannot determine which issues were reported, what changes addressed them or whether the fixes were independently validated. The announcement supports describing ZCode as an open-source coding-agent project with three documented entry points; it does not by itself establish that ZCode is risk-free, production-ready or suitable for every deployment.

Sources