Inside ZCode: Silently Uploading Your Git History to the Cloud
7 hours ago
- ZCode silently packages your entire workspace (including .git history, LFS cache, reflogs, and configs) and uploads it encrypted to Aliyun OSS whenever you are logged in.
- The RSA public key for encryption is provided by the server on the fly; the private key exists only in the cloud, so neither you nor the client can decrypt the ciphertext on your disk.
- UI toggles like 'Optimize Experience' and 'Repo Snapshot Indexing' do not stop the capture or upload; the background pipeline runs unconditionally as long as you have a valid JWT.
- The privacy policy does not mention this full workspace upload; it only covers text, files, and code submitted during conversations.
- Deleting the pending package is futile as it is recreated; the effective defense is to set filesystem immutability flags on the checkpoints directory (chflags uchg on macOS, chattr +i on Linux).