GLM (hummin)

Run GLM on hummin

hummin is the GLM-native CLI: a pi-harness fork that runs headless in Docker against your Z.ai GLM Coding Plan. Since v0.31.0 it's the default way to run GLM in RoboCo - the Z.ai row in the provider picker fronts it, and the manual Anthropic-protocol path stays available as a fallback.

The automatic default model is glm-5.3-flash:high, and the hummin mode seeds per-role reasoning tiers out of the box: board roles, reviewers, and the Main PM run :high, delivery roles run :low. You can override any of it per role or per agent like any other provider.

Set it up once

  1. Get a Z.ai API key (the GLM Coding Plan).
  2. In the panel, open Settings → AI Providers, paste the key into the Z.ai box, and save it. The key is encrypted server-side and injected as ZAI_API_KEY at spawn - no credential mount, no refresh loop, and the initial prompt travels as an environment variable, never as an argv token.
  3. Flip the routing mode to hummin, or pin agents in Mix mode.

hummin agents run in their own image, which runs hummin's own auth check (--provider zai) before the first prompt: a bad key parks the session with the standard rate-limit/auth taxonomy instead of crash-looping.

Guardrails without a hook surface

hummin has no PreToolUse hook surface, so the fleet's bash-guard cannot install into it. The boundary is hummin's own strict per-role --tools allowlist, rendered from the fleet's permission rules: an agent can only use the tools its role allows, and nothing else. Two deliberate V1 limits follow from the missing surfaces:

  • hummin has no MCP client, so the RoboCo gateway is unreachable from inside a hummin agent. Completion still reaches the orchestrator (the owned-task path), and a bridge extension is the named follow-up.
  • The bash-guard cannot install, so the tool allowlist is the only in-container boundary.

Your vault stays yours

The container forces HUMMIN_MEMORY=0, so hummin's memory extension can never write to your personal vault.

Usage and cost

Usage is scraped from hummin's own structured run log (the tee'd --mode json output): a real four-bucket token split across all assistant turn-end events, with turns counted as assistant messages. One pricing note: glm-5.3-highspeed has no published rate yet, so it is attributed at the glm-5.3 rates - the safe direction (slight over-attribution) until a real price lands.

Next

llms.txt