[zwanski-start]

Closes #10

Context

GLM was already available as a provider, but several gaps made GLM 4.x hard to use in practice:

• The Base URL was fixed to api.z.ai, yet the UI hint pointed users to open.bigmodel.cn. Mainland-China keys need https://open.bigmodel.cn/api/anthropic, and there was no way to set it.
• You could only pick from a fixed model list (no GLM 4.6, no plain glm-4.5).
• No request timeout was applied. Z.ai recommends API_TIMEOUT_MS=3000000 for long planning turns, which is the failure mode the issue describes.

Changes

• registry.py: added glm-4.6 to the GLM models. Added default_timeout_ms: "3000000" to the GLM provider. get_effective_sdk_env() now uses the provider's default timeout when the user hasn't set api_timeout_ms.
• SettingsModal.tsx / SettingsView.tsx: GLM now shows the editable Base URL field (pre-filled with the z.ai default) and the custom model ID input. The hint text explains both endpoints.
• README / .env.example: step-by-step GLM setup, the China endpoint, and API_TIMEOUT_MS.
• New test_api_providers.py (5 tests) for the GLM env (defaults, custom model + China URL, timeout override, no default timeout for other providers). Listed in CLAUDE.md.

Verification

• pytest test_api_providers.py test_client.py: 26 passed. python test_security.py: all passed. ruff check . is clean, and mypy on the changed files is clean.
• ui: npm run lint gives 0 errors (the 6 warnings were already there). npm run build succeeds.
• Ran the server locally (port 5345, isolated HOME), switched the provider to GLM via PATCH /api/settings, and checked Settings with Playwright. The Base URL shows https://api.z.ai/api/anthropic with a Change button, the models are GLM 5 / 4.7 / 4.6 / 4.5 Air, and the custom model input is shown.

Assumptions

• The default timeout applies only to GLM. Other providers behave as before.
• I did not test against a live GLM API (no key available).
• The PR comes from a fork (zwanski-start/autoforge) because the bot account only has read access to the upstream repo.

🤖 Generated with Claude Code

[arkaccess]

🔍 QA report: ✅ Passed

Tester: Ada (cubefarm agent, in a fresh session) · Round: 1 · Author: Ken

The PR closes the GLM 4.x gaps from issue #10. In the UI you can now change the GLM Base URL (China endpoint) and enter any GLM model ID, glm-4.6 is listed, and GLM gets API_TIMEOUT_MS=3000000 by default, which an explicit setting overrides. I verified this end to end: UI changes saved through PATCH /api/settings, and get_effective_sdk_env() produced the China URL, the custom model on all tiers and the timeout. New and related tests, ruff, the UI build and lint are clean, and the pytest/mypy failures are identical on master.

	Check	Details
✅	Acceptance: custom GLM model IDs + GLM 4.6	Settings shows GLM 5/4.7/4.6/4.5 Air plus a custom model input. Entering 'glm-4.5' saved api_model=glm-4.5, and get_effective_sdk_env() set ANTHROPIC_DEFAULT_{OPUS,SONNET,HAIKU}_MODEL=glm-4.5.
✅	Acceptance: China endpoint configurable	The GLM Base URL shows the z.ai default with a Change button. Changing it to https://open.bigmodel.cn/api/anthropic in the browser saved it, and it flows into ANTHROPIC_BASE_URL. Switching the provider back to GLM resets it to the z.ai default.
✅	Acceptance: default timeout for GLM	API_TIMEOUT_MS=3000000 is set for GLM and an explicit api_timeout_ms overrides it (unit tests). Kimi/other providers get no default timeout.
✅	Code review	Small, focused diff (registry.py provider entry + fallback, UI visibility flags/placeholder/hint, docs, new tests). No security.py or localhost-middleware changes, no DB schema changes, no debug leftovers. Minor non-blocking notes: SettingsModal.tsx isn't rendered anywhere (SettingsView is live; both got identical edits); after setting a custom model no model button is highlighted (pre-existing for Ollama/Custom).
✅	REST validation	GET /api/settings, /api/settings/providers and /api/settings/models return 200 with glm-4.6 listed. PATCH with api_model=123 returns 422.
✅	Secrets not logged	The auth token set through PATCH did not appear in the server log, and the API response exposes only api_has_auth_token.
✅	Browser: Settings UI, console	Settings page rendered with GLM selected, the Base URL change and custom model flows worked, and the console had 0 errors and 0 warnings.
✅	Responsive (390x844)	Usable but cramped, because the sidebar doesn't collapse at phone width (pre-existing). The new hint's long URL gets clipped (cosmetic).
✅	Full pytest / mypy parity with master	21 pytest failures and 25 mypy errors, identical on an origin/master worktree. The pytest failures are async tests in test_devserver_security.py: pytest-asyncio isn't installed in this env.
⏭️	UI e2e (npm run test:e2e)	The specs (conversation-history, tooltip) don't touch settings and need a Vite dev server on 5173, not my reserved port. Covered by the manual browser check instead.
⏭️	Live GLM API call	No key; per the QA policy, agent env behaviour is checked by code and unit tests.

🧪 Commands run

Command	Result
pip install -r requirements.txt (scratch venv, Python 3.14)	ok
npm --prefix ui ci	ok
python -m pytest test_api_providers.py test_client.py -v	26 passed
python -m pytest -q (full)	149 passed, 21 failed: same 21 fail on origin/master (pytest-asyncio missing)
ruff check .	All checks passed
mypy . / mypy registry.py test_api_providers.py	25 errors, identical to master / changed files clean
python test_security.py	ALL TESTS PASSED
python test_security_integration.py	ALL INTEGRATION TESTS PASSED
npm --prefix ui run build	success, no type errors
npm --prefix ui run lint	0 errors, 6 warnings (pre-existing)
uvicorn server.main:app --host 127.0.0.1 --port 5571 + curl GET/PATCH /api/settings*	200s, 422 on invalid type; settings persisted
python -c get_effective_sdk_env()	BASE_URL=open.bigmodel.cn, models=glm-4.5, API_TIMEOUT_MS=3000000, ANTHROPIC_API_KEY=''

No browser screenshots were taken in this round.

_{Posted by cubefarm · merges automatically once GitHub's checks pass}