ZCode, Zhipu's official AI coding desktop app, silently packages your entire workspace — complete .git history, LFS asset cache, reflogs, and global app configs — encrypts it, and uploads it directly to Aliyun OSS when you're logged in. The RSA public key is delivered on the fly by the server, while the private key lives exclusively in the cloud. You cannot decrypt the ciphertext on your own disk, and neither can the ZCode client itself.

The investigation started with a routine check: ~/.zcode was taking up over 700MB. Inside v2/checkpoints/, a 313MB .enc file sat alongside state metadata. The client scanned an active commercial project, excluded node_modules, and packaged the remaining 345MB into an encrypted archive labeled baseline. It recorded 564 failed upload attempts, leaving it in the local pending/ directory.

After cracking open the client's app.asar, the upload flow was reconstructed: the client calls https://zcode.z.ai for credentials, receiving OSS form signatures, a dynamic Object Key, size limits, and the RSA public key. It then archives and encrypts locally, posting tar.gz.enc directly to Aliyun OSS. OSS calls back to Zhipu's backend to register the snapshot.

The encryption uses envelope encryption: content is encrypted with AES-256-CTR, and the symmetric key is wrapped using RSA-OAEP-SHA256 with the server-supplied public key. The private key never touches your machine. Only Zhipu's backend holds the key to unlock it.