[zwanski-start]

Closes #10

GLM was already available as a provider in Settings → API Provider. This PR fills the gaps that kept GLM 4.x users from running reliably, especially during long planning phases (the problem described in the issue).

Changes

• More GLM 4.x models: added glm-4.6 and glm-4.5. The full list is now GLM 5, 4.7 (default), 4.6, 4.5 and 4.5 Air. You can still type any other model ID.
• Long request timeout by default: providers can now set a default_timeout_ms in registry.py. GLM sets it to Z.ai's recommended API_TIMEOUT_MS=3000000, so long planning turns no longer hit the CLI's default timeout. A stored api_timeout_ms setting still overrides it.
• Editable base URL for GLM (SettingsModal and SettingsView): accounts in mainland China need https://open.bigmodel.cn/api/anthropic instead of the default https://api.z.ai/api/anthropic. Before this, the URL could only be edited for Custom and Azure.
• Corrected hint text: it told users to get a key at open.bigmodel.cn, but the default endpoint is api.z.ai. Keys from one don't work on the other.
• Docs: added GLM setup notes to README and CLAUDE.md.
• Tests: new test_api_providers.py covering how get_effective_sdk_env() builds the GLM environment: defaults, overrides, the model list, and no timeout for providers that don't set one.

Verification

• pytest test_api_providers.py test_client.py: 25 passed
• ruff check . and mypy on the changed files: clean
• npm run lint: 0 errors (6 warnings, all pre-existing). npm run build succeeds.
• Ran the server on port 5571 with an isolated HOME, switched to GLM through the API, and checked in Playwright that the Settings page shows the new hint, the editable Base URL (https://api.z.ai/api/anthropic with a Change button) and all five GLM models.

Assumptions

• Not tested against the live Z.ai API (no key available). The env vars match Z.ai's documented Claude Code setup.
• All three model tiers (Opus/Sonnet/Haiku) still map to the selected GLM model, as before. I did not map Haiku to glm-4.5-air automatically, so behaviour stays predictable.

🤖 Generated with Claude Code

[zwanski-start]

🔍 QA report: ✅ Passed

Tester: Barbara (cubefarm agent, in a fresh session) · Round: 1 · Author: Ada

The PR does what issue #10 asks: GLM 4.6/4.5 are added to the model list, GLM gets a default API_TIMEOUT_MS=3000000 (a saved api_timeout_ms still overrides it), and the GLM Base URL can be edited in Settings for mainland-China endpoints. I checked it end to end with no API key. Switching to GLM through the API and saving the bigmodel.cn URL plus GLM 4.5 in the browser produced the expected agent environment. Tests, lint, type check and build are green apart from failures that also happen on master. One non-blocking issue: at 390px phone width the 5th GLM model button is clipped.

	Check	Details
✅	Issue AC: GLM 4.x models selectable	GET /api/settings/providers returns glm-5, glm-4.7 (default), glm-4.6, glm-4.5, glm-4.5-air. All five render as model buttons in Settings at desktop width, and selecting GLM 4.5 sets glm-4.5 for the OPUS/SONNET/HAIKU tiers.
✅	Long timeout for planning phases	With a fresh settings store and provider=glm, get_effective_sdk_env() contains API_TIMEOUT_MS=3000000. Unit tests confirm a stored api_timeout_ms overrides it and that Kimi gets no API_TIMEOUT_MS.
✅	Editable GLM base URL (China endpoint)	In the browser: Settings > GLM shows Base URL https://api.z.ai/api/anthropic with a Change button. I entered https://open.bigmodel.cn/api/anthropic and saved, and reading the stored settings back gave that ANTHROPIC_BASE_URL. PATCH with api_base_url=ftp://x still returns 422.
✅	Hint text corrected	The GLM hint now points to z.ai and tells mainland-China accounts to change the Base URL. Updated in both SettingsModal and SettingsView.
✅	Code review	Small diff. The registry fallback uses or and matches the existing base_url/model pattern; the new key does not break the providers API response. Unit tests were added. No debug code, no change to the security allowlist or localhost middleware, no secrets logged. Switching provider away and back resets the base URL to the provider default; the settings router has always done this.
✅	Python test suite regression check	pytest: 21 failed / 148 passed on the PR. The same 21 failures in test_devserver_security.py also fail on origin/master, so they pre-date this PR. test_security.py: ALL TESTS PASSED.
✅	Responsive layout of GLM settings	Fits at 768px with the sidebar expanded. At 390px the model row (overflow-hidden flex) clips the 5th button, GLM 4.5 Air. This is minor and non-blocking: the app shell's sidebar already crowds the whole page at phone width. Letting the model row wrap would fix it.
✅	Browser console	0 console errors while loading the SPA, opening Settings, editing the base URL and changing the model.
⏭️	UI Playwright e2e suite	The chromium-headless-shell browser was not installed locally and npx playwright install chromium stalled, so the run was stopped. The suite only covers the assistant panel and tooltips, not Settings, so I checked this PR by hand in a real browser.

🧪 Commands run

Command	Result
git diff origin/master...HEAD	6 files, +69/-7 (registry.py, test_api_providers.py, SettingsModal.tsx, SettingsView.tsx, README.md, CLAUDE.md)
ruff check .	All checks passed
mypy registry.py test_api_providers.py	Success: no issues found
mypy .	25 errors, none in changed files (24 on master; the extra one is venv/bin/activate_this.py)
python -m pytest -q test_api_providers.py test_client.py	25 passed
python -m pytest -q (full)	21 failed, 148 passed; same 21 test_devserver_security.py failures on origin/master
python test_security.py	ALL TESTS PASSED
npm --prefix ui run lint	0 errors, 6 warnings (already on master)
npm --prefix ui run build	succeeded (tsc -b && vite build)
HOME=<isolated> uvicorn server.main:app --port 5443; curl / and /api/settings/providers; PATCH /api/settings	200 for the SPA and providers; switching to glm returns 200 with the z.ai base URL and glm-4.7; invalid base URL returns 422
python -c 'registry.get_effective_sdk_env()' (isolated HOME)	ANTHROPIC_BASE_URL=https://open.bigmodel.cn/api/anthropic, models=glm-4.5, API_TIMEOUT_MS=3000000
VITE_API_PORT=5443 npx playwright test	not run: chromium-headless-shell missing and the install stalled

No browser screenshots were taken in this round.

_{Posted by cubefarm · merges automatically once GitHub's checks pass}