kind: context
name: z-ai
version: 1
description: "Z.ai GLM coding plan — Anthropic-compatible proxy"
requires: []
provides: [claude-code]

env:
  ANTHROPIC_BASE_URL: "https://api.z.ai/api/anthropic"
  CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS: "1"
  CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
  DISABLE_PROMPT_CACHING: "1"

secrets_required:
  - name: z-ai
    account_ref: "z-ai"
    mount_path: /run/agent/secrets/z-ai
    # 0400 (root-only) — defense in depth. The agent user cannot read this
    # mount. init.sh runs as root and stages the auth_token into the agent's
    # home with mode 0600. apiKeyHelper points at the staged copy. Matches
    # the gitea-ssh pattern; if the ESO Secret later carries additional
    # files (e.g. base_url is already there), they remain inaccessible.
    mode: "0400"

scripts:
  init: "./init.sh"

# TODO: Add network_hosts for api.z.ai when context harnesses support it