ZCode silently uploads encrypted Git history to Aliyun OSS with server-held keys

The core change is the discovery that ZCode performs background uploads of entire workspace snapshots, including complete Git history, LFS caches, and reflogs. The data is packaged into a tar.gz archive, encrypted with AES-256-CTR, and wrapped with an RSA-OAEP key before being sent directly to Aliyun OSS. This behavior occurs whenever the user is logged in, regardless of whether they are actively using the AI features.

The security model relies on envelope encryption where the symmetric key is wrapped by an RSA public key delivered dynamically by the server. Because the corresponding private key never touches the user's machine, the ciphertext stored locally in the ~/.zcode directory is unreadable by the user or the client itself. This architecture ensures that only Zhipu's backend can decrypt and access the uploaded intellectual property, effectively bypassing local data sovereignty.

Adopting or continuing to use ZCode carries the cost of exposing proprietary code and historical data to a third-party cloud service without explicit, granular consent. The investigation revealed that the upload pipeline bypasses ZCode's application servers for the actual data transfer, posting directly to OSS using signed credentials. This direct upload mechanism makes the data transfer harder to intercept or block at the application layer without modifying the client's network behavior.

The feature stops working as a user-controlled backup or sync tool because the necessary decryption keys are not available locally. Unlike standard version control or time-machine systems where users retain key ownership, this design serves the purpose of server-side accessibility rather than user convenience. The presence of hundreds of failed upload attempts in the local state files indicates that the system aggressively retries these transfers, potentially consuming bandwidth and disk space for data the user cannot access.

The discrepancy between the local plaintext manifest and the encrypted payload highlights a significant transparency gap. While the file inventory is visible locally, the actual content remains locked behind server-held keys. This separation allows the client to appear to be managing local state while simultaneously exfiltrating sensitive data to a remote cloud provider, a pattern that contradicts typical expectations for desktop development tools.