Z.ai open-sourced ZCode, and the NOTICE.md admits there's no default OS sandbox.

zai-org/ZCode went public September 20 under Apache-2.0, reaching 4,942 stars and 1,378 forks in about 24 hours. The fork-to-star ratio is unusually high for a day-old repo, which usually means people are cloning and building rather than bookmarking. It's a TypeScript monorepo shipping an Electron desktop app, a browser/terminal workbench and a zcode Agent CLI that doubles as runtime for both. The NOTICE.md is a real risk disclosure: no default OS sandbox, working directory and workspace identity and git worktree and browser page isolation and the Node REPL must not be treated as system-level isolation, and the standalone CLI invoked with --prompt and no --mode runs in yolo. It also warns that a model claiming a task is done is not evidence that it is.