Changelog

Notable changes to this project, loosely following Keep a Changelog. Entries before v0.1.0 are grouped by date; from v0.1.0 on, sections are tagged.

2026-08-03 (post-v0.1.0)

Fixed

• Streaming span lifecycle for observability hooks. The OTel/Hook seam created a per-attempt span inside connectChatStream/connectAnthropicStream but never propagated it into the stream context, so OnStreamChunk recorded nothing and the span was never ended on clean stream completion (unfinished spans leaked to the exporter). The attempt context now flows through to chunk hooks, clean completion fires OnResponse (ending the span), mid-stream errors attribute to the captured span, and Attempt is correctly populated on chunk/error hooks instead of being stamped 0. Regression-tested (pkg/client/stream_test.go).
• extractUsage missed embeddings and async results. usageBearer was implemented only by *ChatResponse, so OnResponse hooks received Usage: nil for embeddings and async (image/video) responses — token usage was invisible to tracing/metrics for those endpoints. EmbeddingsResponse and AsyncResultResponse now implement GetUsage().
• NewOTelHookWithProvider panicked on a nil provider. The comment claimed a nil MeterProvider/TracerProvider yielded a no-op and "never panics," but passing a literal nil dereferenced a nil interface. Both args now fall back to the global no-op provider when nil.
• pkg/observe: errors.As simplification. The manual **APIError unwrap chain was replaced with a plain errors.As(err, &ae) (the prior comment's claim that errors.As doesn't type-match **T was wrong).
• Accounts-store path was wrong in the docs. The docs said ~/.config/go-z-ai/accounts.json; the code (intentionally, for upgrade compat) uses ~/.config/zai-client/accounts.json. Docs now match the code.
• Dead link in CONTRIBUTING. A 404 sitegen URL was replaced with a neutral note that the markdown under docs/ is the source of truth.
• Langfuse overclaim removed. Docs and code comments referenced Langfuse as a pkg/observe implementation; only OpenTelemetry ships. Corrected in docs/en/library-guide.md, pkg/client/hook.go, pkg/client/client.go.
• Examples corrected. quickstart-vision no longer falsely claims the client auto-base64-encodes local files (it passes URLs verbatim); audio-tts requests wav explicitly (the API default is raw PCM) and names its output accordingly; observability no longer overclaims metrics (metrics are emitted only when a MeterProvider is registered); quickstart-structured handles its marshal error; chat-tools comment reworded.
• Compliance/usage-policy warning ported to all translated READMEs (de/ru/zh/tr/tt); previously it existed only in the English README.
• Locale README switchers now consistently link back to the English README and bold the current language.
• .github/ISSUE_TEMPLATE/bug_report.yml label updated from the legacy zai-client name to go-z-ai.

Changed

• examples/README.md now documents all twelve example programs instead of four, and no longer tells readers that tools/vision/structured-output examples live "in the Library Guide" when they exist in examples/.
• .github/SETUP.md corrected to reference the Announcements Discussion category (matching .goreleaser.yml's discussion_category_name), not Releases.
• .github/workflows/ci.yml coverage-floor comment corrected: it referenced nonexistent pkg/agent/pkg/mcp packages; now mentions only pkg/observe.
• Makefile clean target also removes the local sitegen binary.

Removed

• Committed sitegen binary (12.7 MB) and generated site/ tree removed from version control. They were introduced by the "extract sitegen to a standalone repo" commit, which deleted the generator source but accidentally left the build artifacts tracked. The /sitegen and site/ .gitignore rules are restored; the files remain on disk for local use.

Security

• go.opentelemetry.io/otel bumped v1.40.0 → v1.41.0 to fix GO-2026-5506 (multi-value baggage header extraction causes excessive allocations — a DoS vector in code paths that propagate incoming baggage headers). All six otel module paths bumped in lockstep.

2026-08-02 (post-v0.1.0)

Fixed

• Monitor usage window was timezone-shifted. The usage model-usage/ tool-usage endpoints exchange zoneless time strings that the server interprets as its own wall-clock (verified live to be CST / UTC+8), but the client formatted startTime/endTime in the viewer's local zone. So accounts usage --today/--days requested a range shifted ~6h and returned the wrong slice. The client now formats the query window in the server's timezone, so the requested absolute range is correct regardless of the viewer's zone.

Changed

• Usage/quota times render in the viewer's local timezone, with the server's zone shown additionally when it differs. Reset times gain a Server: line (the boundary that actually clears a limit) only when the server zone differs from local; the accounts usage heat-map header converts its span to local time and prints a one-line note naming the server zone. The returned x_time bucket labels (server-local, zoneless) are converted to local for display.
• Config.MonitorTimezone / --monitor-timezone / ZAI_MONITOR_TIMEZONE override the server-timezone assumption (default CST/UTC+8). Accepts IANA names (Asia/Shanghai), UTC, local, or offsets (+8, UTC-05:00). Client.MonitorTimezone() exposes the resolved zone so render layers can relabel. pkg/client.ParseTimezone is the shared parser.

2026-07-19 (post-v0.1.0)

Added

• Observability hooks (pkg/client/hook.go): a stdlib-only Hook interface (OnRequest/OnResponse/OnError/OnStreamChunk) attached via Config.Hooks. Fires on every request/response/error/stream-chunk through the centralized doRequest facade and the new streaming iterators. Empty by default — the no-hook path is zero-allocation. RequestMeta carries Service/Method/Endpoint/Model/Attempt; ResponseMeta adds StatusCode/Duration/Usage. Services stamp Service/Model into the context via the public WithService/WithModel helpers; the facade reads them back when building metadata.
• pkg/observe package — concrete OpenTelemetry hook (OTelHook) emitting GenAI semantic-convention spans and metrics: one span per request attempt (retries produce N child spans), gen_ai.system=z.ai, request/response model, HTTP status, token-usage counters (input/output, by model), request-duration histogram, request-count by status. First public package with third-party deps (go.opentelemetry.io/otel v1.40.0); pkg/client stays stdlib-only. Construct via observe.NewOTelHook(serviceName) (uses global providers) or NewOTelHookWithProvider(...) for isolated/test setups.
• examples/observability — end-to-end demo wiring OTelHook onto a client and streaming a chat completion with stdout span export.
• Iterator-based streaming (pkg/client/stream.go): ChatService.Stream(ctx, req) iter.Seq2[StreamChunk, error] and AnthropicService.Stream(ctx, req) iter.Seq2[AnthropicStreamEvent, error], compatible with Go 1.23+'s range-over-func. The recommended streaming API going forward. Producer goroutine + buffered channel adapts the existing SSE parsers (readSSE, readAnthropicSSE) to iter.Seq2; context cancellation tears down the in-flight stream without leaking the producer. Connect-phase retry/backoff is preserved verbatim (extracted into connectChatStream/connectAnthropicStream, shared by both APIs).
• Curated model catalog (pkg/client/models_catalog.go) — the single source of truth for the model metadata /models does not return (context window, max output, pricing, capabilities, family/tier, release date, description). 15 models spanning GLM-5.x/4.x/OCR. ModelDetails gains enrichment-only fields (MaxOutput, Family, Tier, Capabilities, CatalogName, CatalogDescription). GetTextModels/GetVisionModels/ GetFreeModels switch from substring heuristics to HasCapability/ IsFree. CLI gains FAMILY/CONTEXT/MAXOUT/CAPS columns; TUI gains a detail view (Enter on any model). Pricing/context transcribed from docs.z.ai/guides/overview/pricing (verified 2026-07-19, noted in source). Live API values always win when present, so the day Z.AI starts sending max_context or pricing in /models the real numbers take over.
• Identifying User-Agent header on every request (go-z-ai/<version>), overridable via Config.UserAgent. Compliance hygiene under Z.AI's coding- endpoint usage policy (which prohibits unidentified SDK access).
• pkg/client.Version() and pkg/client.UserAgent() exports — library-visible version populated by GoReleaser ldflags (-X github.com/SamyRai/go-z-ai/pkg/client.version=x.y.z). Defaults to "dev" for from-source builds. Enables downstream feature detection and identifier reuse.

Deprecated

• ChatService.CreateStream and AnthropicService.CreateStream (the callback-based streaming APIs) — replaced by Stream (iter.Seq2). The deprecated variants delegate to Stream so existing callers keep working unchanged; both will be removed in v1.0. All internal callers (CLI chat and anthropic subcommands, TUI chat stream) migrated to Stream.

Fixed

• TUI overlay placeOverlay was built but never applied. The variable was constructed and trimmed but never passed to lipgloss.Place; now wired.
• Makefile: LYCHEE_FLAGS now includes --exclude 'localhost' so local make docs-lint matches CI (the parity the comment claimed but didn't deliver).
• docs/en/architecture.md: collapsed two MD012 double-blank-line runs and stripped trailing whitespace at EOF.
• internal/tui/models/detail.go: fmt.Fprintf over WriteString(fmt.Sprintf(...)) per staticcheck QF1012.

2026-07-19

Open-source readiness pass: community files, examples, CI hardening, and the first tagged release path. The local .env (never in git history) remains gitignored — no keys were exposed or rotated.

Added

• CODE_OF_CONDUCT.md (Contributor Covenant 2.1) with a contact address matching SECURITY.md.
• README.zh.md — Simplified-Chinese README mirroring the English structure, with cross-language links at the top of both READMEs.
• examples/ — three runnable package main programs (compiled by CI's go build ./...) covering the three core API shapes:
  • examples/chat-streaming — Chat().CreateStream callback streaming.
  • examples/async-poll — Images().GenerateAsync + WaitForResult.
  • examples/anthropic-messages — the Anthropic-compatible /v1/messages. Each has a per-example description and is linked from the top-level README.
• Makefile wrapping the contributor commands (build, vet, test, test-cover, fmt, fmt-check, lint, vuln, tidy, ci-local).
• --version on zai-client (now go-z-ai), populated by GoReleaser ldflags at release time (version, commit, date vars in main.go).
• .github/workflows/release.yml + .goreleaser.yml — tag-triggered (v*) GoReleaser build for linux/amd64, linux/arm64, darwin/amd64, darwin/arm64, with SBOM (spdx-json) and keyless cosign/sigstore signing via OIDC. Creates a GitHub Release with an auto-generated changelog and publishes to the Releases Discussion category.
• README: "How it relates to the official SDKs" section noting there is no official Go SDK (Python/Node/Java only), and a callout that zai-claude-config.json is a template, not a real config.

Changed

• CI hardening (.github/workflows/ci.yml):
  • Added concurrency block — cancels superseded PR runs.
  • test and lint jobs now run on an OS matrix (ubuntu-latest, macos-latest) since the project ships a darwin binary and a TUI.
  • Tests now produce a coverage profile (go test -race -coverprofile) and upload cover.out as an artifact; a coverage summary is printed.
  • Pinned govulncheck to v1.1.4 instead of @latest for reproducibility.
• .gitignore now covers .zcode/ and .claude/ at the repo level (previously .zcode/ was covered by nothing and .claude/ only by a per-developer global ignore — both are local agent/CLI working state that must never ship).

Documentation

• README docs table now links to CODE_OF_CONDUCT.md.
• Note on the global-vs-China endpoint feature matrix in docs/accounts-and-quota.md confirmed already accurate for mid-2026 (embeddings/moderations/rerank/batch/voice on open.bigmodel.cn only; the GLM-5.2 flagship model is supported; the deprecated Assistant API is deliberately not implemented — see docs/roadmap.md).

Security (no incident)

• Verified via git log --all --full-history -- .env (empty) and a source scan for the Z.AI key format that no credentials were ever committed. All VCR cassettes carry Bearer REDACTED. No key rotation was needed; the local .env stays ignored.

Changed (follow-up)

• Replaced the Go Report Card badge with OpenSSF Scorecard in both READMEs. goreportcard.com sunset its public badge service on July 1, 2026 (after 11 years); the badge endpoint now serves a static "retired" placeholder for every repo, so the badge had become meaningless. Added .github/workflows/scorecard.yml running ossf/scorecard-action weekly and on branch_protection_review, uploading SARIF to the Security tab and exposing the score via api.securityscorecards.dev. SETUP.md updated accordingly.

2026-07-18

Added

• Regional gateway selection (Config.Region / --region / ZAI_REGION). Z.AI serves the same GLM model family from two regional gateways: the international host api.z.ai (the historical default) and the China mirror open.bigmodel.cn. Previously only Embeddings/Moderations were wired to the China host; monitor (quota/usage), biz (account info), agents, and account detection were hardcoded to api.z.ai, so a glm_coding_plan_china key couldn't reach its own region's usage/account endpoints and got mis-classified by accounts add/account detect. Config.Region (RegionGlobal, the default, or RegionChina) now selects the host for monitor, biz, agents, and detection. From the CLI: --region {global,china} or ZAI_REGION env (aliases cn, bigmodel, west); an unknown value falls back to global rather than erroring. internal/coding/plans.go mirrors this with MonitorBaseURL / BizBaseURL / AgentsBaseURL plan helpers. The China hosts are NOT VERIFIED LIVE (modeled by mirroring the api.z.ai path layout on open.bigmodel.cn, which is live-verified for /models and /chat/completions). See docs/architecture.md.
• Chat-completion API sync (pkg/client/types.go, chat.go). New fields matching the current docs.z.ai chat-completion spec, all additive and NOT VERIFIED LIVE until a cassette pins them:
  • ChatRequest.StreamToolCall — streamed tool-call deltas (GLM-4.6+).
  • Tool now discriminates across function / retrieval / web_search types via NewFunctionTool / NewRetrievalTool / NewWebSearchTool. The web_search payload shape ({"search_query":[...]}) follows the official Python SDK example; retrieval and the full tool-type support are unverified live.
  • ChatResponse.WebSearch — the top-level web_search array returned when a web_search tool fires (entry shape reuses WebSearchResult from tools.go).
  • ThinkingConfig.Effort now documents xhigh (GLM-5.2; xhigh→max). validateChatRequest rejects unknown effort values client-side.
  • FinishReason* constants for the live values sensitive, model_context_window_exceeded, network_error.
  • Client-side tool-name guard (^[A-Za-z0-9_-]{1,64}$), a 128-function cap, and per-type payload validation (a function/retrieval/web_search tool must carry its matching payload; unknown types are rejected).
• Live-verification scaffolding for four more services in pkg/client/live_verify_test.go: Voice Clone, Voice Delete, Chat-Stream-Tool-Call, and Chat-Web-Search-Response. Each skips until a cassette exists (CI stays green); record one with ZAI_RECORD=1 ZAI_API_KEY=<key> go test -run TestVerify<Name> ./pkg/client (the harness redacts Authorization to Bearer REDACTED before saving).

Docs

• Aligned every doc with the 2026-07-18 sprint: --region/ZAI_REGION added to the CLI Reference global-flags table; xhigh added to the --effort values; Config.Region added to the Library Guide Config table; the new tool types (NewRetrievalTool/NewWebSearchTool), StreamToolCall, ChatResponse.WebSearch, the FinishReason* constants, the 128-function cap, and the tool-name regex documented in the Library Guide's Function calling section; Accounts & Quota's "China platform key" rewritten as "Regional gateways" covering both the Embeddings/Moderations axis and the monitor/biz/agents/detection axis; Getting Started's China note reframed; Architecture's "three services" corrected to four (detection also went region-aware).
• Rewrote docs/roadmap.md as a crisp, current task list — every "Unverified live" item names its exact TestVerify* test + recording command, grounded in the cassette inventory (no item was removed: none of the unverified services got a success cassette this sprint).
• Renamed pkg/client/live_verification_test.go → live_replay_test.go so the two live-test files self-document: live_replay_test.go holds the Test*Live replay-only tests (frozen findings), live_verify_test.go holds the TestVerify* recording harness. No behavior change.
• Index completeness: docs/README.md now lists .github/SETUP.md and .env.example; root README.md's doc table now matches the docs/ index (Roadmap, Security, Changelog rows added).
• .github/PULL_REQUEST_TEMPLATE.md checklist aligned with CONTRIBUTING.md (added golangci-lint run and govulncheck).

2026-07-17

Changed

• Repository layout (breaking for importers of the app packages). The CLI command code moved from package main at the repo root into internal/cli (a five-line root main.go now just calls cli.Execute()), and the in-repo-only packages pkg/tui, pkg/usageview, pkg/accounts, and pkg/coding moved under internal/. Only pkg/client remains a public, importable package — the documented library surface is now compiler-enforced. go install github.com/SamyRai/go-z-ai@latest still produces the go-z-ai binary; CLI behavior and --help output are unchanged. If you imported pkg/accounts or pkg/coding directly (previously documented as reusable), that import path no longer exists — drive the functionality through the accounts/coding CLI commands instead.
• interface{} → any throughout (mechanical; any is an alias, so pkg/client's exported signatures are unchanged for consumers).

Added

• Consistent --format text|json on every result-producing command. batch, files, image, video, rerank, and ocr gained JSON output (were text-only); embeddings/moderations keep JSON as the default but gained a text summary. Progress messages on JSON-capable commands now go to stderr so stdout stays valid JSON.
• First tests for the CLI layer: credential-precedence coverage (resolveConfig), an end-to-end cobra harness against httptest, and unit tests for buildChatRequest and the new internal/fileinput helper.

Internal

• runWithClient wrapper replaces the four-line getClient preamble repeated across ~50 command handlers. addFormatFlag/emit helpers centralize output formatting. internal/fileinput.FileOrURL de-duplicates the OCR file/URL handling previously copied between ocr parse and the TUI media tab.

Fixed

• accounts list/show/current --format json masked the API key like the table view does (it previously printed the raw key); --reveal opts into raw keys for export/backup.
• usage/account status now correctly reports an insufficient-balance account as accessible but out of balance instead of inaccessible. It classifies the failure from the structured *APIError (code/HTTP status) rather than string-matching a message; distinguishes 401 (auth) and 429 (rate limit) too.
• TUI: submitting a media job (esp. a multi-minute video) and switching tabs no longer strands the result — async results are routed back to the originating tab, with esc-to-cancel.

Testing / docs

• First unit tests for the credential store (internal/accounts), every TUI tab, and the CLI credential-precedence path. New opt-in live-verification harness (ZAI_RECORD=1) records redacted cassettes for previously docs-only success shapes (Anthropic Messages, Embeddings, Moderations, Agents). Noted the vision + tool-calling 401 pitfall in the CLI reference.

2026-07-12

Added

• Quota burn-rate ("Pace") indicator on token windows in accounts quota / usage quota and the TUI Usage tab: extrapolates each rolling window's own reported usage against elapsed window time to flag when you're on pace to run out before reset (62% used at 55% of window elapsed — on pace to run out ~24m before reset). Straight-line math on real API fields — no peak/off-peak pricing assumptions. New QuotaLimit.WindowDuration()/WindowStart() and usageview.Pace/FormatPace (the first tests for the previously untested usageview package). Directly targets the common "limits run out sooner than expected" complaint.
• Anthropic-compatible Messages client (AnthropicService, c.Anthropic()) — a typed Go client for Z.AI's /api/anthropic surface (POST /v1/messages), the endpoint the GLM Coding Plan points Claude Code at, parallel to the OpenAI-style Chat service. Covers Create, streaming CreateStream (raw Anthropic SSE events), text/image/tool_use/tool_result content blocks, tools (with the same schema-compat rewrite), and Bearer auth + anthropic-version header. New CLI: anthropic messages <prompt> [--stream ...]. Routing/auth are confirmed reaching the live endpoint (bogus key → clean HTTP 401); the success-path body shape is documented, not yet live-verified (see Roadmap).
  • Extended thinking: AnthropicThinking request config, thinking/ redacted_thinking response blocks, and resp.Thinking() — which falls back to an OpenAI-style reasoning_content field if GLM surfaces reasoning that way instead of as a thinking block (the claude-code-router#1133 case). CLI --thinking-budget N enables it and prints reasoning to stderr.
• Tool-schema compatibility: chat requests now normalize tool (function) parameters into the flat JSON-Schema subset GLM's parser accepts, instead of letting anyOf/oneOf/allOf/$ref/$defs reach the endpoint and come back as an opaque HTTP 500 (a pain point for tools generated from typed languages — nullable fields, reused structs, composed types). Nullable unions collapse to their underlying type, allOf merges, and local $refs inline (with cycle protection). Exposed as client.SanitizeToolSchemas for explicit use, applied automatically before every chat request, and disablable via Config.DisableToolSchemaCompat. See pkg/client/toolschema.go and Library Guide. The exact set of server-rejected constructs is drawn from community reports, not yet reproduced live here (see Roadmap).
• coding mcp add/remove/status: registers Z.AI's official Vision MCP Server (@z_ai/mcp-server — screenshot OCR, error-screenshot diagnosis, diagram/chart understanding, image/video analysis via GLM-4.6V) into any of the five supported coding tools, matching the "manage MCP services" step of the official @z_ai/coding-helper wizard that this client otherwise ports in full. Each tool gets its correct file and JSON shape — notably, Claude Code and Factory Droid keep MCP config in a different file than their provider/credential config. Available from the CLI and the TUI's Coding tab (m key).

Changed

• golangci-lint is now part of the gate: a checked-in .golangci.yml (default linter set — errcheck, govet, ineffassign, staticcheck, unused), a golangci-lint CI job on every push/PR, and a line in the CONTRIBUTING pre-PR checklist. The config deliberately keeps io.Reader.Read checked so the short-read pattern below can't come back unnoticed.

Fixed

• Short-read bug in test HTTP servers — a single r.Body.Read into a ContentLength-sized buffer (Read isn't guaranteed to fill the buffer in one call, so body assertions could flake). A first pass fixed four files; golangci-lint then surfaced eight more occurrences across the moderations, rerank, tools, voice, and layout tests, now all on io.ReadAll.
• staticcheck SA9003 empty if branch in main.go's config load, collapsed to the same _ = ... idiom already used for the .env load above it.

2026-07-11

Added

• Agents service (Invoke, AsyncResult) — live-verified, including the 200-with-embedded-business-failure response quirk both endpoints share.
• Embeddings, Moderations, Rerank, Voice (cloning), and FileParser services and CLI commands.
• Handwriting OCR (ocr handwriting), distinct from layout parsing (ocr parse).
• A go-vcr-based live-verification test suite (now pkg/client/live_replay_test.go + live_verify_test.go, testdata/cassettes/) that replays real recorded API interactions instead of hand-written fixtures.
• Cursor as a fifth supported coding tool alongside Claude Code, OpenCode, Crush, and Factory Droid.
• Full documentation rewrite: a docs/ guide (Getting Started, CLI Reference, Accounts & Quota, Coding Tools, Library Guide, Error Handling, Architecture), CONTRIBUTING.md, SECURITY.md, this changelog, and a CI workflow (build/vet/gofmt/test -race/govulncheck).

Changed

• Module path renamed to github.com/SamyRai/go-z-ai (was the non-installable zai-api-client) ahead of the public release.
• Licensed under Apache 2.0.
• pkg/coding's API-key validator no longer mutates http.DefaultClient (a shared global) — it now bounds the request with context.Context instead, fixing a data race under concurrent callers (the TUI validates keys from a background goroutine).
• Config-file writers in pkg/coding (the credential store and every third-party tool config it edits) now write atomically via temp-file-then-rename, matching the pattern pkg/accounts already used — a crash mid-write can no longer truncate your Claude Code/OpenCode/Crush/ Factory Droid/Cursor settings.
• Resource IDs (batchID, fileID, task IDs) are now URL-path-escaped before being interpolated into request paths.
• Removed unused "legacy compatibility" error constructors/sentinels from pkg/client that had no real callers anywhere in the codebase.

2026-07-10

Added

• Streaming chat completions (SSE), with CLI chat create --stream.
• Structured output (json_schema response format, --json-schema).
• Function-calling: a RunWithTools/RunWithToolsLimit auto-executing loop, plus CLI tool declarations (--tool).
• Deep-thinking controls (--thinking, --effort) and advanced sampling flags (--stop, --top-p, --do-sample, --show-reasoning).
• Automatic retry with exponential backoff, jitter, and Retry-After support on 429/5xx/network errors.
• Multimodal messages (Message.Images) for vision models (GLM-4.6V/4.5V), wire-compatible with plain-text messages when no image is attached.
• Image generation (glm-image/CogView-4), video generation (CogVideoX-3/Vidu, always async), audio transcription/TTS, and OCR (layout parsing) services and CLI commands.
• Files and Batch API services for bulk/async request processing.
• A full-screen terminal UI (zai-client tui, now go-z-ai tui) with seven tabs: chat, models, usage, accounts, coding, media, tools.
• pkg/usageview, a presentation-only package shared by the CLI and TUI so usage/quota rendering (time windows, heat maps, relative timestamps) can't drift between the two.

Changed

• context.Context is now the first parameter on every pkg/client service method, threaded all the way to the HTTP call.
• Removed a provider/app-config abstraction layer in favor of the simpler multi-account model.

Fixed

• CreateStream no longer gets cut off mid-generation by Config.Timeout — the timeout now bounds dial/TLS/response-header wait, not the whole response body read.
• Tools, Account, and Quota services no longer built their own unconfigured http.Client per call (bypassing retry, timeout, and structured error parsing) — routed through the shared request facade.

2026-07-08

Added

• Initial release: chat completions, models, usage/quota/billing monitoring, and account operations, as both a CLI and a Go client library.
• A Go port of @z_ai/coding-helper (pkg/coding) for configuring Claude Code, OpenCode, Crush, and Factory Droid to use a GLM Coding Plan credential, sharing the official helper's ~/.chelper/config.yaml file.
• Multi-account credential management (pkg/accounts) with automatic coding_plan/pay_as_you_go type detection.
• Structured API error parsing with categories, user-facing messages, and retriable flags.