feat(skills): add bundled glm-review skill (cross-model code review via z.ai GLM)

CHANGELOG.md

@@ -8,6 +8,17 @@ new version heading in the same commit.
 
 ## [Unreleased]
 
+## [0.84.0] — 2026-07-10
+### Added
+- **Bundled skill: `glm-review`** — a fast, one-shot **cross-model** code review using z.ai's GLM
+  models via their Anthropic-compatible API. Self-contained (`SKILL.md` + `glm-review.sh`, needs only
+  `curl`/`jq` and a `ZAI_API_KEY` env var; `gh` for `--pr`). Reviews the current repo's diff
+  (uncommitted / `--staged` / `--base <branch>` / `--pr <N>`), prints concrete bugs / security /
+  edge-cases / simplifications most-severe-first, and is description-triggered ("review with GLM", or
+  before opening/merging a PR). An independent second opinion alongside the host's own review. No
+  behavioural change to the platform — it only reads a diff and calls an API; any resulting change is
+  still governed by the gateway.
+
 ## [0.83.0] — 2026-07-10
 ### Added
 - **Scheduler concurrency cap `AOS_MAX_CONCURRENT_SESSIONS` (#137).** Defense-in-depth against the

config/skills/glm-review/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: glm-review
+description: Get a fast CROSS-MODEL code review of the current git diff (or a GitHub PR) from z.ai's GLM model — an independent second opinion alongside your primary reviewer. Use before opening or merging a PR, when the user asks to "review with GLM / z.ai / a different model", or to sanity-check a Claude review. Requires ZAI_API_KEY in the environment.
+license: MIT
+---
+
+# GLM code review
+
+A fast, **one-shot cross-model** review of a code diff using z.ai's GLM models (via their
+Anthropic-compatible API) — a cheap second opinion that catches what a single reviewer misses.
+Different model, different blind spots: agreement across models raises confidence; disagreement
+flags a spot worth a closer look.
+
+It reviews the diff of the **current git repo**, so run it from inside the checkout you're working in.
+
+## Requirements
+- **`ZAI_API_KEY`** in the environment (a z.ai API key). Without it the tool exits with a clear error.
+- `curl` + `jq` on PATH; `gh` only for `--pr`.
+- Optional: `ZAI_ANTHROPIC_URL` to point at a different Anthropic-compatible base (default `https://api.z.ai/api/anthropic`).
+
+## Use it
+Run the bundled script from your repo:
+
+```bash
+bash .claude/skills/glm-review/glm-review.sh              # review uncommitted changes (git diff HEAD)
+bash .claude/skills/glm-review/glm-review.sh --staged     # staged changes
+bash .claude/skills/glm-review/glm-review.sh --base main  # main...HEAD (your feature branch)
+bash .claude/skills/glm-review/glm-review.sh --pr 2310    # a GitHub PR (needs gh)
+bash .claude/skills/glm-review/glm-review.sh --model glm-5.2   # pick a model (default: glm-4.6)
+bash .claude/skills/glm-review/glm-review.sh --json       # raw API JSON instead of just the text
+```
+
+It prints GLM's review — concrete bugs, security issues, missed edge-cases/callers, and clear
+simplifications, most-severe first with `file:line` + a one-line fix (or "no blocking issues").
+
+## How to use the result
+Treat it as a **second opinion, not a verdict**: verify each point against the code before acting.
+It pairs well with a primary review (e.g. the host's own `/code-review`) — run both and reconcile.
+The gateway still governs any change you make as a result; this skill only reads a diff and calls an API.

config/skills/glm-review/glm-review.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# glm-review.sh — a fast, one-shot CROSS-MODEL code review using z.ai's GLM models
+# (via their Anthropic-compatible API). An independent second opinion alongside your
+# primary reviewer. Reviews a diff from the CURRENT git repo — run it from inside the
+# checkout you're working in.
+#
+# Requires: $ZAI_API_KEY in the environment (z.ai API key); `curl` + `jq`; `gh` only for --pr.
+#
+# Usage:
+#   glm-review.sh                  # review uncommitted changes (git diff HEAD)
+#   glm-review.sh --staged         # review staged changes
+#   glm-review.sh --base <branch>  # review <branch>...HEAD (e.g. your feature branch vs main)
+#   glm-review.sh --pr <N>         # review a GitHub PR (needs gh)
+#   glm-review.sh --model <name>   # override model (default: glm-4.6; e.g. glm-5.2, glm-4.7)
+#   glm-review.sh --json           # print the raw API JSON instead of just the review text
+set -euo pipefail
+
+MODEL="glm-4.6"; MODE="uncommitted"; BASE=""; PR=""; JSON=0
+ENDPOINT="${ZAI_ANTHROPIC_URL:-https://api.z.ai/api/anthropic}/v1/messages"
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --staged)  MODE="staged"; shift ;;
+    --base)    MODE="base"; BASE="${2:?--base needs a branch}"; shift 2 ;;
+    --pr)      MODE="pr"; PR="${2:?--pr needs a number}"; shift 2 ;;
+    --model)   MODEL="${2:?--model needs a name}"; shift 2 ;;
+    --json)    JSON=1; shift ;;
+    -h|--help) sed -n '2,14p' "$0"; exit 0 ;;
+    *) echo "unknown arg: $1 (see --help)" >&2; exit 2 ;;
+  esac
+done
+
+: "${ZAI_API_KEY:?set ZAI_API_KEY (z.ai API key) in the environment}"
+command -v jq   >/dev/null || { echo "glm-review needs jq" >&2; exit 3; }
+command -v curl >/dev/null || { echo "glm-review needs curl" >&2; exit 3; }
+
+case "$MODE" in
+  uncommitted) DIFF="$(git diff HEAD)" ;;
+  staged)      DIFF="$(git diff --staged)" ;;
+  base)        DIFF="$(git diff "${BASE}...HEAD")" ;;
+  pr)          command -v gh >/dev/null || { echo "glm-review --pr needs gh" >&2; exit 3; }
+               DIFF="$(gh pr diff "$PR")" ;;
+esac
+
+# Nothing to review?
+if [ -z "${DIFF//[$'\t\r\n ']}" ]; then echo "glm-review: no diff to review (mode=$MODE)"; exit 0; fi
+# Cap the diff so a huge changeset still fits the request.
+DIFF="$(printf '%s' "$DIFF" | head -c 120000)"
+
+SYS='You are a senior code reviewer giving a fast, cross-model second opinion. Review ONLY the provided diff. Report concrete correctness bugs, security issues, missed edge cases / callers, and clear simplifications — most-severe first, each with a file:line and a one-line fix. Be terse; skip praise. If the diff is clean, say "no blocking issues".'
+
+REQ="$(jq -n --arg m "$MODEL" --arg s "$SYS" --arg d "Review this diff:"$'\n\n'"$DIFF" \
+  '{model:$m, max_tokens:2048, system:$s, messages:[{role:"user", content:$d}]}')"
+
+RESP="$(curl -sS --max-time 180 "$ENDPOINT" \
+  -H "x-api-key: ${ZAI_API_KEY}" -H "anthropic-version: 2023-06-01" -H "content-type: application/json" \
+  -d "$REQ")"
+
+if [ "$JSON" = 1 ]; then echo "$RESP"; exit 0; fi
+echo "── GLM review (${MODEL}) ─────────────────────────────────────────"
+echo "$RESP" | jq -r '.content[0].text // .error.message // ("unexpected response: " + (.|tostring))'

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-os",
-  "version": "0.83.0",
+  "version": "0.84.0",
   "description": "A generic, governed operating system for running autonomous agents safely across brands. Ships with a local web console.",
   "license": "MIT",
   "type": "commonjs",