Legacy Systems (Windows Server 2012)

The standard CLI embeds a Node.js 22 runtime and requires Windows 10 / Server 2016 or later. Older systems lack the system APIs it depends on, and installing a runtime library will not fix it (see Windows Support for the details).

This page provides a separately maintained slim build: the runtime is Node.js 12 (the last version that supports Server 2012), packaged as a single exe. The target machine does not need Node, nor any DLL.

Check that you actually need this

If your machine runs Windows 10 / Server 2016 or later, use the standard build (Professional Usage) — it has more tools and is maintained more actively. This page is for older systems only; the slim build gives up some capabilities on newer systems.

Download

zqagent-lite-win-x64.exe (about 29 MB, single file for 64-bit Windows)

Supported: Windows Server 2012 / 2012 R2 / 2008 R2, Windows 7 SP1, Windows 8 / 8.1. The embedded runtime links the CRT statically — no extra runtime library needed. x64 only — 32-bit and ARM are not available.

Usage

1. Place the file and configure

Put the exe anywhere, for example D:\zqagent\zqagent-lite-win-x64.exe.

DeepSeek is built in by default (https://api.deepseek.com / deepseek-flash), so you only need to provide the API key — one command:

bat

zqagent-lite-win-x64.exe node --set-key sk-your-key

This works in every situation: it writes the config file directly, so it does not depend on environment variables, the user account, or the current directory. That matters because a service runs as SYSTEM, and SYSTEM cannot read user-level setx variables at all. If a startup task is already installed, the command restarts it so the key takes effect right away.

Verify afterwards (each value is labelled with where it came from):

bat

zqagent-lite-win-x64.exe node --show-config

  API Key : sk-xx****abcd   ← config.json
  baseURL : https://api.deepseek.com   ← built-in default
  model   : deepseek-flash   ← built-in default

Only edit baseURL / model in %APPDATA%\zqagent\config.json if you want a different provider or model.

2. Run

bat

cd /d D:\work\myproject
D:\zqagent\zqagent-lite-win-x64.exe

Always cd into the project directory first

The program treats the current directory as the workspace. When you double-click the exe, the current directory is the exe's own folder, so the workspace would be wrong and it would start poking around your install directory.

For non-interactive runs (scheduled tasks / batch files), use --yes to auto-approve file writes and command execution:

bat

D:\zqagent\zqagent-lite-win-x64.exe --once "count the ts files under src" --yes

3. Smoke test

bat

D:\zqagent\zqagent-lite-win-x64.exe --version
D:\zqagent\zqagent-lite-win-x64.exe --help

Capabilities

The slim build keeps what you need for everyday work:

Capability	Details
File read/write	`list_files` / `read_file` / `write_file` / `replace_in_file`
Code search	`grep` (regex, recursive, skips `node_modules`)
Run commands	`run_shell` (cmd.exe, persistent cwd, kills the process tree on timeout)
Web	`web_search` (Bing RSS, falls back to DuckDuckGo, no API key needed), `web_fetch`
Task list	`todo_write`, prints progress in the terminal
Plan approval	`propose_plan` — approve / reject / write extra requirements to request a revision
Sub-agent	`explore` — read-only research in an isolated context
Context compaction	Automatic summarization past a threshold, so long sessions do not overflow

Not included: session persistence and resume, MCP, image and audio input, background tasks, parallel agents. Per-turn iteration limit is 800; the explore sub-agent defaults to 30 rounds.

Joining a hub as a node (remote control)

Beyond local use, it can connect to the gateway and show up in the hub console's node list, ready to receive work remotely.

The first time you need an enrollment code generated by an admin in the hub:

bat

D:\zqagent\zqagent-lite-win-x64.exe node --enroll-code ABCD-1234 --label "2008r2-file-server"

Credentials are saved to %APPDATA%\zqagent\fleet.json; afterwards just start it plain:

bat

D:\zqagent\zqagent-lite-win-x64.exe node

Supported remote commands:

Command	Purpose
`ping` / `get_node_info` / `get_node_host`	Connectivity, node info, host info (CPU/memory/disk/sessions)
`list_projects` / `get_config` / `update_config`	Projects and config — changing the workspace from the console goes here
`list_dirs` / `search_dirs`	Directory browsing (for picking a workspace)
`list_files` / `read_file` / `write_file` / `grep`	File operations
`run_command`	Run a command (destructive commands are still rejected)
`submit_turn`	Remote work — runs the local agent engine, streams back
`interrupt` / `cancel_turn`	Abort the current turn

These panels also render normally (valid empty results or real data): list_sessions, list_tools (the real 11 tools with risk levels), project_stats, get_session_states, get_events, list_mcp, terminal_list, list_shell_tasks.

Everything else (git panel, live terminal, MCP config, session management, usage billing, self-update) returns ok=false with an explicit reason instead of failing silently.

Limits: one turn at a time per node (no steering); one working directory per process (it cannot be switched while a turn is running); local conversation history is lost on restart; no live terminal panel.

Clock requirement: the gateway requires the handshake timestamp to be within ±60 seconds. Old machines with a dead CMOS battery or no NTP can drift by minutes. This program calibrates against the gateway time and retries once when the first auth is rejected, logging the actual skew.

Can't reach the model (intranet / proxy)

The usual cause is that the machine cannot reach the internet at all. Run the built-in check first — it tells you exactly which layer is broken:

bat

zqagent-lite-win-x64.exe node --check

[1/4] DNS 解析失败: api.deepseek.com —— EAI_AGAIN
[2/4] 连接失败: getaddrinfo EAI_AGAIN api.deepseek.com
  → 域名解析失败：本机 DNS 查不到 api.deepseek.com。
    可能原因：内网机器不能直连外网 / DNS 服务器不通 / 需要 HTTP 代理。
    用代理：set HTTPS_PROXY=http://代理地址:端口

Four fixes, in order:

1. Use an HTTP proxy (most common in corporate networks)

bat

setx HTTPS_PROXY "http://proxy-host:8080"
:: with authentication
setx HTTPS_PROXY "http://user:pass@proxy-host:8080"

Takes effect in a newly opened cmd. HTTPS_PROXY / HTTP_PROXY / ALL_PROXY (either case) and NO_PROXY are supported. Node 12 does not honour these variables on its own — this program implements the CONNECT tunnel itself, so the proxy is genuinely used.

2. Point baseURL at an internal gateway in %APPDATA%\zqagent\config.json:

json

{
  "apiKey": "sk-your-key",
  "baseURL": "https://your-internal-gateway/v1",
  "model": "your-model"
}

3. Verify DNS itself works: nslookup api.deepseek.com. If it fails, the machine's DNS needs a forwarder — ask your ops team.

4. Self-signed certificate on an internal gateway: on SELF_SIGNED_CERT_IN_CHAIN you can bypass temporarily (insecure, intranet only):

bat

setx NODE_TLS_REJECT_UNAUTHORIZED "0"

Start on boot (service)

The node is meant to stay running; it should not need a human to start it after a reboot. Register it with Task Scheduler (built into Windows, no extra dependency):

bat

:: run cmd as Administrator
cd /d D:\work\myproject
D:\zqagent\zqagent-lite-win-x64.exe node --install-service

This registers a task named zqagent-lite and starts it immediately. Afterwards:

Command	Purpose
`node --service-status`	Show task status and the log tail
`node --uninstall-service`	Stop and remove the task

The task does three things that are easy to miss: no execution time limit (the default is 72 hours, after which Windows kills it), restart 1 minute after a crash (up to 3 times), and an explicit working directory (the default is C:\Windows\System32, which would make the node poke around the system directory).

Configuration not found after installing as a service?

The task runs as SYSTEM, while setx writes user-level environment variables by default — SYSTEM cannot see them. One command fixes it (it also restarts the installed task):

bat

zqagent-lite-win-x64.exe node --set-key sk-your-key

Or write %APPDATA%\zqagent\config.json by hand:

json

{
  "apiKey": "sk-your-key"
}

That single field is enough — the endpoint and model have built-in defaults (DeepSeek).

Priority: command line > environment variable > config.json > built-in default. With no console attached, logs go to %APPDATA%\zqagent\logs\node.log (rotated past 5 MB) — that is your only diagnostic.

Interactive commands

Command	Purpose
`/exit`	Quit (Ctrl+C is unreliable on older systems — prefer this)
`/clear`	Clear the conversation history
`/model <name>`	Switch model
`/plan`	Toggle read-only plan mode
`/todo`	Show the current task list
`/compact`	Force context compaction before the next request

Verifying the download

Each release also publishes a .sha256 file next to the exe:

bat

:: fetch the checksum
curl -O https://agent.cd-zq.com/downloads/zqagent-lite/zqagent-lite-win-x64.exe.sha256

:: built into Windows 10 1803+ / Server 2019+
certutil -hashfile zqagent-lite-win-x64.exe SHA256

If the old system has no curl, open the .sha256 link in a browser and save it.

Troubleshooting

SmartScreen or antivirus blocks the exe The build is not Authenticode-signed (it wraps a modified Node runtime base), so some environments flag it. Add an allow-list entry in controlled intranet environments; sign it with signtool for public distribution.

Missing api-ms-win-crt-*.dll This should not happen — the embedded Node 12 links the CRT statically and does not depend on those DLLs. If it does, install KB2999226.

Node mode cannot connect / keeps reconnecting Read the reason the program prints: AUTH rejected usually means a wrong secret or node binding; code 1006 is usually network, or a middlebox blocking the WebSocket upgrade; if the log says it already calibrated the clock and still fails, the skew exceeds 10 minutes — fix the system time first.

Mojibake in Chinese outputchcp 65001 helps (the program tries to switch automatically at startup). If the underlying command emits GBK and the system has no GBK decoder, some mojibake remains — a known limit of older systems.

Does it work on an isolated intranet? Yes. Only calls to the model endpoint need outbound access; web_search will fail without affecting the other features.

Legacy Systems (Windows Server 2012) ​

Download ​

Usage ​

1. Place the file and configure ​

2. Run ​

3. Smoke test ​

Capabilities ​

Joining a hub as a node (remote control) ​

Can't reach the model (intranet / proxy) ​

Start on boot (service) ​

Configuration not found after installing as a service? ​

Interactive commands ​

Verifying the download ​

Troubleshooting ​

Related ​