Date: 2026-09-22
Method: Offline static analysis. Both AppImages downloaded from the official CDN, --appimage-extracted, app.asar extracted with @electron/asar, minified JS bundles analyzed. No app was executed; no network traffic was captured live. All claims below are from the shipped code itself (minified but with intact function names via a(fn,"name") debug annotations, which makes attribution reliable).
- v3.12.3 (pre-remediation):
https://cdn-zcode.z.ai/zcode/electron/releases/3.12.3/linux-x64/ZCode-3.12.3-linux-x64.AppImage - v3.14.1 (current):
https://cdn-zcode.z.ai/zcode/electron/releases/3.14.1/linux-x64/ZCode-3.14.1-linux-x64.AppImage
Extracted copies retained at /tmp/opencode/zcode/extracted/{3.12.3,3.14.1} (temp dir; re-derivable from the CDN URLs).