feat: add Z.AI GLM models as router provider

[rizkydwicmt]

Summary

Adds Z.AI (Zhipu AI) GLM models as a new provider option for Shannon's router mode, enabling pentesting with Chinese-developed large language models.

Changes

Router Configuration (configs/router-config.json)

• Added zai provider with endpoint https://api.z.ai/api/coding/paas/v4/chat/completions
• Configured models: glm-5, glm-4.7, glm-4.7-flash
• Uses the same maxcompletiontokens transformer pattern as OpenAI

SDK Environment Forwarding (src/ai/claude-executor.ts)

• Bug fix: Forward ANTHROPIC_BASE_URL, ANTHROPIC_AUTH_TOKEN, and ROUTER_DEFAULT env vars to the SDK subprocess
• Without this fix, the SDK subprocess doesn't know about the router and tries to authenticate directly with Anthropic, causing AuthenticationError: Invalid API key
• This fix benefits all router providers (OpenAI, OpenRouter, Z.AI, etc.), not just Z.AI

Docker & CLI

• Added ZAI_API_KEY to docker-compose.yml router service environment
• Added ZAI_API_KEY to shannon CLI provider key validation checks

Documentation

• Updated .env.example with Z.AI configuration section
• Updated README.md with Z.AI in Quick Setup and Experimental Models table

Testing

• Verified Z.AI API connectivity with glm-4.7 model via curl
• Successfully ran full Shannon pentest pipeline through router with glm-4.7
• Pre-recon agent completed 405 turns of code analysis successfully
• Recon agent running with 385+ turns of vulnerability discovery

Usage

# .env
ZAI_API_KEY=your-zai-api-key
ROUTER_DEFAULT=zai,glm-4.7

# Run
./shannon start URL=https://target.com REPO=target-repo ROUTER=true

[Copilot]

Pull request overview

This PR adds Z.AI (Zhipu AI) GLM models as a new router provider for Shannon's experimental multi-model support, alongside an important bug fix for router mode environment variable forwarding.

Changes:

• Added Z.AI provider configuration with GLM models (glm-5, glm-4.7, glm-4.7-flash) to the router
• Fixed SDK subprocess environment variable forwarding for ANTHROPIC_BASE_URL, ANTHROPIC_AUTH_TOKEN, and ROUTER_DEFAULT (critical for all router providers)
• Updated CLI validation, Docker configuration, and documentation to include Z.AI API key support

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
configs/router-config.json	Added Z.AI provider configuration with GLM models and maxcompletiontokens transformer; reformatted existing providers for consistency
src/ai/claude-executor.ts	Fixed router mode by forwarding required environment variables to SDK subprocess; corrected comment indentation
shannon	Added ZAI_API_KEY validation checks in router mode API key logic and error messages
docker-compose.yml	Added ZAI_API_KEY environment variable to router service
.env.example	Added Z.AI configuration section with example API key and model settings
README.md	Added Z.AI to experimental router mode documentation and models table

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.