ZCode’s fresh story is not that an agent suddenly appeared. It is that Z.ai opened the desktop, web and terminal code while version 3.14 added a scriptable multi-agent control layer.
ZCode 3.14 combines two developments. Z.ai published an Apache-2.0 repository for ZCode on September 20, 2026, exposing desktop, local-web and terminal-agent components. Its September 19 version 3.14.0 release added dynamic workflows that can coordinate multiple subagents from one script, Office and Coding modes, independent plan use, Computer Use improvements and a full-access option in approval dialogs. Version 3.14.1 followed on September 21 with fixes for Computer Control startup, plugin drafts, thinking text and provider identity.
The release timeline matters
| Date | Event | What changed |
|---|---|---|
| September 19 | ZCode 3.14.0 | Dynamic workflows, new modes, approval changes and Computer Use improvements |
| September 20 | Public repository | Desktop, web and terminal-agent source appears under Apache-2.0 |
| September 21 | ZCode 3.14.1 | Targeted fixes for control startup, plugins and interface behavior |
Calling ZCode itself a brand-new product would be inaccurate. The useful news is that its implementation is now inspectable while the 3.14 release line changes how teams can orchestrate agents and grant permissions.
Three operating surfaces serve different jobs
| Surface | Best fit | Boundary to inspect |
|---|---|---|
| Desktop application | Interactive coding and Computer Use | Local files, screen access and approval settings |
| Local web mode | Browser-based access to a running instance | Bind address, authentication token and network exposure |
| Terminal agent | Repository and automation workflows | Shell commands, working directory and environment secrets |
The repository documentation says web mode listens on 127.0.0.1 without a token by default. Binding to a non-local address generates a token unless authentication is explicitly disabled. That is a sensible distinction, but operators can still create a dangerous configuration by exposing the service through a reverse proxy or container network without preserving authentication.
Dynamic workflows make the agent graph programmable
Version 3.14.0 describes dynamic workflows as scripts that orchestrate multiple subagents. This can turn a broad instruction into specialized parallel or sequential work: one agent can inspect requirements, another can implement, and a third can run tests or review the result. The workflow script becomes part of the product’s behavior and should be reviewed with the same care as application code.
- Pin which subagent handles each stage rather than relying on an ambiguous default.
- Pass the minimum context each stage needs.
- Set limits for retries, time, tokens and spawned work.
- Keep write access with the implementing stage, not every reviewer.
- Require a test or artifact before a workflow reports completion.
The Kiro Crew governance analysis explains why multi-agent throughput does not remove review obligations. Our Unity agent plugin guide shows a narrower example in which agent context is useful only when execution remains scoped.
Full access is a permission mode, not a speed feature
The changelog adds a full-access option to approval dialogs. That can reduce interruptions during trusted repetitive work, but it also changes the blast radius of a mistaken instruction, compromised dependency or prompt injection. Teams should treat full access as an exceptional session mode with an explicit start, scope and expiry.
| Permission choice | Safer use | Risk signal |
|---|---|---|
| Approve once | New command or unfamiliar repository | Agent repeatedly asks for broader variants |
| Approve bounded pattern | Known test and formatting commands | Pattern includes shell expansion or unrelated paths |
| Full access | Disposable environment with clear rollback | Production credentials, broad home directory or external publishing |
A useful test grants full access inside a throwaway repository, places a protected file outside the working directory and asks the workflow to recover from an intentionally failing task. The expected result is not simply completion. It is completion without crossing the repository boundary or exposing secrets.
The model and the harness should be evaluated separately
Z.ai’s product material identifies GLM-5.3 as the primary agent harness model and includes GLM-5.3-Flash for multimodal work. Model quality is only one part of the experience. The open repository also determines tool schemas, approval handling, context assembly, recovery and the way subagent results return to the main workflow.
- Run the same task through desktop, web and terminal modes.
- Record model choice, context, tool calls and approval prompts.
- Repeat with one subagent and then a scripted multi-agent workflow.
- Compare accepted patches, retries, elapsed time and total usage.
- Inspect whether a failed subagent leaves partial file or external changes.
- Test the web token behavior from another machine on the same network.
What the open repository enables
Public source makes it possible to audit authentication defaults, follow bug fixes, inspect runtime interfaces and build reproducible packages. Apache-2.0 is a permissive software license, but it does not convert third-party models, services or bundled assets into Apache-licensed material. A production review should list every external provider and dependency separately.
The practical verdict
ZCode 3.14 is most interesting as an inspectable agent platform with three operating surfaces and a scriptable subagent layer. The new repository improves auditability. The new workflow and full-access controls increase both capability and responsibility. Evaluate them first in a disposable environment, keep web mode local by default and require explicit review before broad permissions enter a persistent workspace.
Primary sources
Checked September 21, 2026. This article distinguishes the newly public repository and 3.14 release line from the older existence of the ZCode product.
