feat: add Z.ai provider, lightweight web panel, and Discord channel

[zarigata]

Summary

This PR adds three new features to Mercury Agent:

1. Z.ai (GLM) provider — First-class support for Z.ai's OpenAI-compatible API with opt-in GLM Coding Plan endpoint
2. Lightweight web panel — Browser-based chat interface using only Node.js built-in node:http
3. Discord channel — Slash command bot with allowlist access control and minimal Gateway intents

What changed

Z.ai Provider (feat(providers))

• Added zai to ProviderName union and MercuryConfig.providers
• Uses existing OpenAICompatProvider (OpenAI-compatible, no new deps)
• Defaults to general endpoint (https://api.z.ai/api/paas/v4)
• Coding Plan endpoint opt-in via ZAI_CODING_PLAN_ENABLED=true
• Added GLM preferred model list for setup wizard model selection
• Added Z.ai API key validation and setup flow in mercury doctor

Web Panel (feat(web))

• src/channels/web-panel.ts — HTTP server using node:http, zero external deps
• Default disabled (WEB_PANEL_ENABLED=false)
• Default localhost-only (127.0.0.1:3977)
• Optional auth token for remote access
• Refuses to bind 0.0.0.0 without auth token unless WEB_PANEL_ALLOW_REMOTE=true
• Rate limiting (60 req/min per IP), 1MB request size limit
• Clean dark-theme HTML UI with status card, chat input, command buttons

Discord (feat(discord))

• src/channels/discord.ts — Slash command bot via discord.js (minimal intents: Guilds only)
• Commands: /mercury ask, status, help, budget, memory, permissions
• Allowlist-based access: DISCORD_ALLOWED_USER_IDS, DISCORD_ADMIN_USER_IDS
• Channel restrictions: DISCORD_ALLOWED_CHANNEL_IDS
• DMs disabled by default
• Deferred responses for long-running tasks
• Response splitting for Discord's 2000-char limit

Documentation (docs)

• docs/providers/zai.md — Setup, models, Coding Plan compliance notice
• docs/channels/web-panel.md — Setup, security model, API endpoints
• docs/channels/discord.md — Bot creation, slash commands, access control
• README updated: provider table + channels table
• .env.example updated with all new config vars
• CHANGELOG.md updated with [Unreleased] section

Tests (test)

• 28 new tests covering:
  • Z.ai config, base URL switching, Coding Plan toggle, missing key, no secret leakage
  • Web Panel defaults, localhost, auth token, no secrets in status
  • Discord allowlist checks, admin-only fallback, message splitting
  • Web Panel refuses 0.0.0.0 without auth

Why

• Z.ai: GLM models are increasingly popular; OpenAI-compatible makes integration trivial
• Web panel: Not everyone wants Telegram; a browser panel is the lowest-friction alternative
• Discord: Teams already on Discord can interact with Mercury without switching tools

How to test

# 1. Install and build
npm install && npm run build

# 2. Run tests
npm test          # 48 tests should pass

# 3. Typecheck
npm run typecheck  # Zero errors

# 4. Test Z.ai provider
ZAI_API_KEY=your-key mercury doctor
# Select "Z.ai (GLM)" from provider list

# 5. Test web panel
WEB_PANEL_ENABLED=true mercury start
# Open http://127.0.0.1:3977

# 6. Test Discord (requires bot token)
DISCORD_ENABLED=true DISCORD_BOT_TOKEN=xxx DISCORD_CLIENT_ID=xxx DISCORD_GUILD_ID=xxx mercury start

Security considerations

• No secrets in logs, tests, or responses — verified by tests
• Web panel defaults to localhost — remote access requires explicit opt-in + auth token
• Discord allowlists enforced — unauthorized users silently ignored
• Z.ai Coding Plan is opt-in — default uses general endpoint
• No new shell/file operations exposed — all agent work routed through Mercury's permission system

Z.ai Coding Plan compliance note

⚠️ GLM Coding Plan benefits are limited to officially supported tools and products. Mercury is not an officially supported product of Z.ai unless explicitly verified. The Coding Plan endpoint is opt-in via ZAI_CODING_PLAN_ENABLED=true. Users are responsible for ensuring their usage complies with their Z.ai plan terms. The general endpoint (https://api.z.ai/api/paas/v4) is used by default.

Files changed

File	Change
src/utils/config.ts	Add zai provider, webPanel and discord channel config
src/providers/registry.ts	Register Z.ai provider
src/utils/provider-models.ts	Add GLM preferred models
src/types/channel.ts	Add 'web-panel' to ChannelType
src/channels/web-panel.ts	New — Web panel channel implementation
src/channels/discord.ts	New — Discord channel implementation
src/channels/registry.ts	Register web panel and Discord channels
src/channels/index.ts	Export new channels
src/index.ts	Z.ai setup flow, status output for new channels
tsup.config.ts	Add discord.js to externals
.env.example	All new environment variables
README.md	Provider + channels table updates
CHANGELOG.md	Unreleased section
docs/providers/zai.md	New — Z.ai documentation
docs/channels/web-panel.md	New — Web panel documentation
docs/channels/discord.md	New — Discord documentation
src/utils/new-features.test.ts	New — Config and provider tests
src/channels/new-channels.test.ts	New — Channel safety tests

Test results

✓ src/utils/provider-models.test.ts (3 tests)
✓ src/utils/telegram-access.test.ts (4 tests)
✓ src/utils/new-features.test.ts (20 tests)
✓ src/memory/user-memory.test.ts (13 tests)
✓ src/channels/new-channels.test.ts (8 tests)

Test Files  5 passed (5)
     Tests  48 passed (48)

Known limitations

• Web panel does not support streaming responses (falls back to buffered)
• Discord file sending is not implemented in this initial version
• Discord slash commands can take up to 1 hour to propagate when using global commands
• Z.ai model catalog fetch depends on their /models endpoint availability
• discord.js is the only new dependency (justified: Mercury's channel model requires persistent Gateway connection)

Checklist

• Fork created
• Feature branch pushed
• Z.ai provider works with general endpoint
• Coding Plan endpoint is opt-in and documented with compliance warning
• Web panel defaults to localhost and disabled
• Remote web panel requires explicit config and auth warning
• Discord channel disabled by default
• Discord allowlists enforced
• Docs updated
• .env.example updated
• Typecheck passes
• Build passes
• Tests pass
• PR opened and ready for review