scalemax 0.1.14 → 0.1.16

package/README.md

@@ -1,6 +1,6 @@
 # ScaleMax CLI
 
-Universal installer for configuring AI coding clients to use the ScaleMax OpenAI-compatible API gateway.
+Universal installer for configuring AI coding clients to use the ScaleMax OpenAI- and Anthropic-compatible API gateway.
 
 ScaleMax CLI is designed to be run from any machine with Node.js installed:
 
@@ -98,7 +98,7 @@ SCALEMAX_API_KEY=sm_live_xxx scalemax models
 
 ## Supported clients
 
-`npx scalemax` supports this client set:
+`scalemax` supports this client set whether it is run through a global install or with `npx`:
 
 - Codex
 - Cursor
@@ -114,7 +114,19 @@ For clients without a stable official config file, the installer writes a ScaleM
 
 ### Claude Code
 
-ScaleMax configures Claude Code with the Anthropic-compatible origin `https://api.scalemax.pro`, preserves unrelated settings and environment variables, and selects a live `claude-*` model from the authenticated model catalog (preferring `claude-opus-4-8`). It verifies `/v1/messages` after setup and rolls back managed changes if verification fails. Claude Code picker aliases such as `claude-opus-4-8[1m]` are normalized by the ScaleMax gateway.
+ScaleMax updates `~/.claude/settings.json` with `ANTHROPIC_BASE_URL=https://api.scalemax.pro`, gateway model discovery, and a cached `apiKeyHelper` that reads a private `~/.claude/scalemax.key` file. The raw key is not stored in the settings JSON. The Anthropic base URL intentionally has no `/v1` suffix because Claude Code adds `/v1/messages` itself. The CLI preserves unrelated settings, selects a live main model from the authenticated catalog (preferring `claude-opus-4-8`), pins authenticated Haiku for lightweight background work when available, and verifies a one-token Messages request. If verification fails, it removes only the ScaleMax-managed changes. Claude Code picker aliases such as `claude-opus-4-8[1m]` are normalized by the gateway.
+
+### OpenCode
+
+ScaleMax merges a named `scalemax` provider into `~/.config/opencode/opencode.json` (or the platform-equivalent config directory). It uses `https://api.scalemax.pro/v1`, reads its credential from the private `~/.config/opencode/scalemax.key` file through OpenCode's `{file:...}` substitution, keeps unrelated providers and the user's non-ScaleMax default model, and loads every model available to the authenticated key. A fresh ScaleMax setup uses authenticated Haiku as `small_model` for quicker lightweight work. Each generated model has an explicit output limit of at most 4096 tokens so OpenCode does not send an unsupported default limit.
+
+### OpenClaw
+
+ScaleMax merges a native `anthropic-messages` provider into `~/.openclaw/openclaw.json`, using the Anthropic origin `https://api.scalemax.pro`. The API key and the compatibility User-Agent are both OpenClaw file-backed SecretRefs stored in private `0600` files under `~/.openclaw/secrets/`; neither value is embedded in the provider JSON. The migration removes exact plaintext ScaleMax key copies from generated agent model registries. It adds every authenticated model to the provider and agent allowlist, uses authenticated Haiku for utility work when ScaleMax is the active provider, caps generated output limits at 4096 tokens, explicitly denies private-network routing for the public gateway, and preserves unrelated providers and agent settings. Legacy ScaleMax artifacts are removed only when they carry the ScaleMax managed marker.
+
+### Hermes
+
+ScaleMax merges a named custom provider into `~/.hermes/config.yaml` and stores its credential in `~/.hermes/.env` with private permissions. Hermes uses OpenAI chat-completions routing at `https://api.scalemax.pro/v1`, a scoped `ScaleMax-Hermes/1.0` user agent, and a 4096-token output cap. Existing non-ScaleMax providers and defaults are preserved; a fresh Hermes config activates `custom:scalemax` automatically.
 
 ### Cursor BYOK routing on macOS
 
@@ -141,6 +153,7 @@ npx scalemax models
 ```
 
 The model list is fetched live from `https://api.scalemax.pro/v1/models` every time, so disabled or unsupported models disappear immediately without manual cache cleanup.
+Key metadata and the authenticated model catalog are fetched concurrently on the normal path. Safe GET checks receive one short, jittered retry on transient network, rate-limit, or server failures; model-generation POST requests are never retried by the installer.
 
 Run diagnostics:
 
@@ -262,7 +275,11 @@ Never publish over an existing npm version. Use semantic versioning for every re
 
 - Existing client configuration files are backed up before writes.
 - Writes are atomic.
+- Identical configurations are not rewritten or backed up again.
+- Invalid JSON/JSON5 client files fail closed instead of being replaced; valid JSON5 values are merged safely.
+- Backup directories are user-only and backup files are written with private permissions.
 - API keys are masked in terminal output.
+- Claude Code, OpenCode, OpenClaw, and Hermes keep generated client credentials in private files rather than shared provider configuration blocks.
 - The published npm package contains only runtime files: `dist/`, `README.md`, `LICENSE`, and `package.json`.
 - Tests, TypeScript source, scripts, local caches, `.env` files, tarballs, and `node_modules` are excluded from the published package.
 
@@ -296,4 +313,4 @@ Yes. The CLI uses Windows-aware config paths and writes `%APPDATA%\scalemax\conf
 
 ### What endpoint does it configure?
 
-`https://api.scalemax.pro/v1`
+OpenAI-compatible clients use `https://api.scalemax.pro/v1`. Anthropic-compatible clients such as Claude Code and OpenClaw use the origin `https://api.scalemax.pro`, because those clients append `/v1/messages` themselves.

package/dist/clients.js

@@ -21,9 +21,9 @@ export const clients = [
     { id: 'cursor', name: 'Cursor', detect: cursorDetect.detect, configure: cursorConfig.configure, verify: cursorConfig.verify, remove: cursorConfig.remove },
     { id: 'trae-solo', name: 'TRAE SOLO', detect: traeSoloDetect.detect, configure: traeSoloConfig.configure, remove: traeSoloConfig.remove },
     { id: 'claude', name: 'Claude Code', detect: claudeDetect.detect, configure: claudeConfig.configure, verify: claudeConfig.verify, remove: claudeConfig.remove },
-    { id: 'opencode', name: 'OpenCode', detect: opencodeDetect.detect, configure: opencodeConfig.configure, remove: opencodeConfig.remove },
-    { id: 'openclaw', name: 'OpenClaw', detect: openclawDetect.detect, configure: openclawConfig.configure, remove: openclawConfig.remove },
-    { id: 'hermes', name: 'Hermes', detect: hermesDetect.detect, configure: hermesConfig.configure, remove: hermesConfig.remove },
+    { id: 'opencode', name: 'OpenCode', detect: opencodeDetect.detect, configure: opencodeConfig.configure, verify: opencodeConfig.verify, remove: opencodeConfig.remove },
+    { id: 'openclaw', name: 'OpenClaw', detect: openclawDetect.detect, configure: openclawConfig.configure, verify: openclawConfig.verify, remove: openclawConfig.remove },
+    { id: 'hermes', name: 'Hermes', detect: hermesDetect.detect, configure: hermesConfig.configure, verify: hermesConfig.verify, remove: hermesConfig.remove },
     { id: 'cherry-studio', name: 'Cherry Studio', detect: cherryStudioDetect.detect, configure: cherryStudioConfig.configure, remove: cherryStudioConfig.remove },
     { id: 'api-code', name: 'API Code', detect: apiCodeDetect.detect, configure: apiCodeConfig.configure, remove: apiCodeConfig.remove }
 ];

package/dist/commands/configure.d.ts

@@ -1,5 +1,8 @@
+import { ModelInfo } from '../utils/api.js';
+import { ClientId } from '../types/client.js';
 export declare function detectAll(home?: string): Promise<import("../types/client.js").DetectionResult[]>;
 export declare function printDetected(home?: string): Promise<import("../types/client.js").DetectionResult[]>;
+export declare function clientAllowedForModels(clientId: ClientId, models: ModelInfo[]): boolean;
 export declare function configureCommand(opts?: {
     all?: boolean;
     home?: string;

package/dist/commands/configure.js

@@ -4,7 +4,7 @@ import ora from 'ora';
 import { clients } from '../clients.js';
 import { SCALEMAX_BASE_URL } from '../constants.js';
 import { loadApiKey } from '../utils/keyStore.js';
-import { validateApiKey } from '../utils/api.js';
+import { validateApiKey, isAnthropicModel } from '../utils/api.js';
 import { homeDir } from '../utils/paths.js';
 export async function detectAll(home = homeDir()) {
     const ctx = { home, platform: process.platform, env: process.env };
@@ -39,14 +39,13 @@ async function maybeLaunchCodex(chosen, successful) {
     }
     console.log('\nIf Codex asks for authentication,\nit should already be configured to use ScaleMax.\n\nIf you still see the official login screen,\nthe configuration is incomplete or Codex rejected the generated auth/config files.\n');
 }
-function clientAllowedForScope(clientId, scope) {
-    if (scope === 'both')
+export function clientAllowedForModels(clientId, models) {
+    if (!models.length)
+        return false;
+    const crossProtocolClients = new Set(['claude', 'opencode', 'openclaw', 'hermes', 'cherry-studio', 'api-code']);
+    if (crossProtocolClients.has(clientId))
         return true;
-    if (clientId === 'claude')
-        return scope === 'anthropic';
-    if (clientId === 'api-code')
-        return true;
-    return scope === 'openai';
+    return models.some(model => !isAnthropicModel(model));
 }
 function scopeHint(scope) {
     return scope === 'both' ? 'OpenAI + Claude' : scope === 'anthropic' ? 'Claude only' : 'OpenAI only';
@@ -62,8 +61,8 @@ export async function configureCommand(opts = {}) {
     if (!keyInfo.models.length)
         throw new Error(keyInfo.error || 'ScaleMax returned no models for this API key. No client configuration was changed.');
     const providerScope = keyInfo.key?.provider_scope || 'both';
-    const availableClients = clients.filter(c => clientAllowedForScope(c.id, providerScope));
-    console.log(chalk.dim(`API key scope: ${scopeHint(providerScope)}. Incompatible clients are hidden.`));
+    const availableClients = clients.filter(c => clientAllowedForModels(c.id, keyInfo.models));
+    console.log(chalk.dim(`API key scope: ${scopeHint(providerScope)}. Clients are filtered against the authenticated model catalog.`));
     const detections = await printDetected(home);
     const detectedIds = new Set(detections.filter(d => d.installed).map(d => d.id));
     let chosen;

package/dist/configure/claude.js

@@ -1,27 +1,104 @@
+import fs from 'fs-extra';
+import crypto from 'node:crypto';
+import path from 'node:path';
+import { atomicWrite, backupFile } from '../utils/fs.js';
 import { clientConfigPath } from './paths.js';
-import { writeMergedJsonConfig, removeManagedConfig } from './common.js';
+import { writeMergedJsonConfig } from './common.js';
 import { GENERATED_HEADER } from '../constants.js';
-import fs from 'fs-extra';
-const id = 'claude', name = 'Claude Code';
-function claudeModel(ctx) { const ids = (ctx.models || []).map(m => m.id).filter(x => x.startsWith('claude-')); for (const preferred of ['claude-opus-4-8', 'claude-sonnet-5', 'claude-opus-4-7', 'claude-opus-4-6', 'claude-haiku-4-5-20251001'])
-    if (ids.includes(preferred))
-        return preferred; if (ids.length)
-    return ids[0]; throw new Error('No Claude models are available for this API key; Claude Code was not changed.'); }
-function anthropicOrigin(baseUrl) { const url = new URL(baseUrl); url.pathname = url.pathname.replace(/\/v1\/?$/, '').replace(/\/$/, ''); url.search = ''; url.hash = ''; return url.toString().replace(/\/$/, ''); }
+import { redactApiKey } from '../utils/apiKey.js';
+import { anthropicOrigin, fastModel, modelIds, preferredModel } from './models.js';
+import { removeClientSecret, rollbackClientSecret, verifyClientSecret, writeClientSecret } from './client-secret.js';
+const id = 'claude';
+const name = 'Claude Code';
+const discoveryKey = 'CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY';
+const fastModelKey = 'ANTHROPIC_DEFAULT_HAIKU_MODEL';
+const helperTtlKey = 'CLAUDE_CODE_API_KEY_HELPER_TTL_MS';
+const managedEnvKeys = ['ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_API_KEY', 'ANTHROPIC_BASE_URL', 'ANTHROPIC_MODEL', discoveryKey, fastModelKey, helperTtlKey];
+function secretPath(home) { return path.join(home, '.claude', 'scalemax.key'); }
+function helperCommand(home, platform) {
+    const file = secretPath(home);
+    if (platform === 'win32')
+        return `powershell -NoProfile -Command "Get-Content -Raw -LiteralPath '${file.replace(/'/g, "''")}'"`;
+    return `cat '${file.replace(/'/g, `'\\''`)}'`;
+}
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
 export async function configure(ctx) {
-    const file = clientConfigPath(id, ctx.home, ctx.platform), model = claudeModel(ctx);
-    const result = await writeMergedJsonConfig(ctx, id, name, file, existing => {
-        const env = existing.env && typeof existing.env === 'object' && !Array.isArray(existing.env) ? existing.env : {};
-        return JSON.stringify({ ...existing, env: { ...env, ANTHROPIC_AUTH_TOKEN: ctx.apiKey, ANTHROPIC_BASE_URL: anthropicOrigin(ctx.baseUrl), ANTHROPIC_MODEL: model }, 'scalemax.managedBy': GENERATED_HEADER, scalemax: { managedBy: 'ScaleMax CLI', anthropicModel: model } }, null, 2) + '\n';
-    });
-    return { ...result, message: `configured Anthropic-compatible routing with ${model}` };
+    const file = clientConfigPath(id, ctx.home, ctx.platform);
+    const model = preferredModel(ctx);
+    const quick = fastModel(ctx);
+    const baseUrl = anthropicOrigin(ctx.baseUrl);
+    const apiKeyHelper = helperCommand(ctx.home, ctx.platform);
+    const secret = await writeClientSecret(secretPath(ctx.home), ctx);
+    let result;
+    try {
+        result = await writeMergedJsonConfig(ctx, id, name, file, existing => {
+            const env = asRecord(existing.env);
+            const oldMetadata = asRecord(existing.scalemax);
+            const previousEnv = oldMetadata.managedBy === 'ScaleMax CLI'
+                ? asRecord(oldMetadata.previousEnv)
+                : Object.fromEntries(managedEnvKeys.filter(key => Object.prototype.hasOwnProperty.call(env, key)).map(key => [key, env[key]]));
+            const previousApiKeyHelper = oldMetadata.managedBy === 'ScaleMax CLI'
+                ? oldMetadata.previousApiKeyHelper ?? null
+                : Object.prototype.hasOwnProperty.call(existing, 'apiKeyHelper') ? existing.apiKeyHelper : null;
+            const nextEnv = {
+                ...env,
+                ANTHROPIC_BASE_URL: baseUrl,
+                ANTHROPIC_MODEL: model,
+                [discoveryKey]: '1',
+                [helperTtlKey]: '900000'
+            };
+            delete nextEnv.ANTHROPIC_AUTH_TOKEN;
+            delete nextEnv.ANTHROPIC_API_KEY;
+            if (quick)
+                nextEnv[fastModelKey] = quick;
+            else
+                delete nextEnv[fastModelKey];
+            return JSON.stringify({
+                ...existing,
+                apiKeyHelper,
+                env: nextEnv,
+                'scalemax.managedBy': GENERATED_HEADER,
+                scalemax: {
+                    managedBy: 'ScaleMax CLI',
+                    anthropicModel: model,
+                    anthropicBaseUrl: baseUrl,
+                    gatewayDiscovery: '1',
+                    fastModel: quick || null,
+                    helperTtl: '900000',
+                    apiKeyHelper,
+                    authTokenSha256: crypto.createHash('sha256').update(ctx.apiKey).digest('hex'),
+                    previousEnv,
+                    previousApiKeyHelper
+                }
+            }, null, 2) + '\n';
+        });
+    }
+    catch (error) {
+        await rollbackClientSecret(secretPath(ctx.home), ctx, secret);
+        throw error;
+    }
+    return { ...result, changed: result.changed || secret.changed, message: `configured Anthropic Messages routing with ${model}, file-backed authentication, and gateway discovery${quick ? `; ${quick} handles background work` : ''}` };
 }
 export async function verify(ctx) {
-    const file = clientConfigPath(id, ctx.home, ctx.platform), settings = await fs.readJson(file);
-    const env = settings?.env || {}, model = String(env.ANTHROPIC_MODEL || '');
-    if (!model.startsWith('claude-') || env.ANTHROPIC_BASE_URL !== anthropicOrigin(ctx.baseUrl) || env.ANTHROPIC_AUTH_TOKEN !== ctx.apiKey)
-        throw new Error('Claude Code settings do not match the authenticated ScaleMax configuration.');
-    const response = await fetch(`${anthropicOrigin(ctx.baseUrl)}/v1/messages`, { method: 'POST', headers: { Authorization: `Bearer ${ctx.apiKey}`, 'anthropic-version': '2023-06-01', 'content-type': 'application/json' }, body: JSON.stringify({ model, max_tokens: 1, messages: [{ role: 'user', content: 'Reply OK' }] }), signal: AbortSignal.timeout(15000) });
+    const file = clientConfigPath(id, ctx.home, ctx.platform);
+    const settings = await fs.readJson(file);
+    const env = asRecord(settings?.env);
+    const model = String(env.ANTHROPIC_MODEL || '');
+    if (!modelIds(ctx).includes(model) || env.ANTHROPIC_BASE_URL !== anthropicOrigin(ctx.baseUrl) || settings.apiKeyHelper !== helperCommand(ctx.home, ctx.platform) || env.ANTHROPIC_AUTH_TOKEN || env.ANTHROPIC_API_KEY || env[discoveryKey] !== '1') {
+        throw new Error('Claude Code settings do not match the authenticated ScaleMax model catalog.');
+    }
+    await verifyClientSecret(secretPath(ctx.home), ctx);
+    const quick = fastModel(ctx);
+    if (quick && env[fastModelKey] !== quick)
+        throw new Error('Claude Code background model does not match the fastest authenticated model.');
+    const response = await fetch(`${anthropicOrigin(ctx.baseUrl)}/v1/messages`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${ctx.apiKey}`, 'anthropic-version': '2023-06-01', 'content-type': 'application/json' },
+        body: JSON.stringify({ model, max_tokens: 1, stream: false, messages: [{ role: 'user', content: 'K' }] }),
+        signal: AbortSignal.timeout(15000)
+    });
     if (!response.ok) {
         let message = `HTTP ${response.status}`;
         try {
@@ -29,8 +106,61 @@ export async function verify(ctx) {
             message = body?.error?.message || message;
         }
         catch { }
-        throw new Error(`Claude Messages verification failed: ${message}`);
+        throw new Error(`Claude Messages verification failed: ${redactApiKey(message, ctx.apiKey)}`);
     }
     return { id, name, changed: false, path: file, message: `verified Anthropic Messages with ${model}` };
 }
-export async function remove(ctx) { return removeManagedConfig(ctx, id, name, clientConfigPath(id, ctx.home, ctx.platform)); }
+export async function remove(ctx) {
+    const file = clientConfigPath(id, ctx.home, ctx.platform);
+    if (!(await fs.pathExists(file))) {
+        const removed = await removeClientSecret(secretPath(ctx.home), ctx);
+        return { id, name, changed: removed, path: file, message: removed ? 'removed orphaned ScaleMax Claude Code credential' : 'no ScaleMax configuration found' };
+    }
+    const settings = await fs.readJson(file).catch(() => undefined);
+    if (!settings || settings?.scalemax?.managedBy !== 'ScaleMax CLI')
+        return { id, name, changed: false, path: file, message: 'left unmanaged configuration unchanged' };
+    const managed = asRecord(settings.scalemax);
+    const env = asRecord(settings.env);
+    const previous = asRecord(managed.previousEnv);
+    const restore = (key) => {
+        if (Object.prototype.hasOwnProperty.call(previous, key))
+            env[key] = previous[key];
+        else
+            delete env[key];
+    };
+    if (env.ANTHROPIC_BASE_URL === managed.anthropicBaseUrl)
+        restore('ANTHROPIC_BASE_URL');
+    if (env.ANTHROPIC_MODEL === managed.anthropicModel)
+        restore('ANTHROPIC_MODEL');
+    if (env[discoveryKey] === managed.gatewayDiscovery)
+        restore(discoveryKey);
+    if (env[fastModelKey] === managed.fastModel)
+        restore(fastModelKey);
+    if (env[helperTtlKey] === managed.helperTtl)
+        restore(helperTtlKey);
+    if (!Object.prototype.hasOwnProperty.call(env, 'ANTHROPIC_AUTH_TOKEN'))
+        restore('ANTHROPIC_AUTH_TOKEN');
+    if (!Object.prototype.hasOwnProperty.call(env, 'ANTHROPIC_API_KEY'))
+        restore('ANTHROPIC_API_KEY');
+    if (typeof env.ANTHROPIC_AUTH_TOKEN === 'string' && crypto.createHash('sha256').update(env.ANTHROPIC_AUTH_TOKEN).digest('hex') === managed.authTokenSha256)
+        restore('ANTHROPIC_AUTH_TOKEN');
+    if (settings.apiKeyHelper === managed.apiKeyHelper) {
+        if (managed.previousApiKeyHelper === null || managed.previousApiKeyHelper === undefined)
+            delete settings.apiKeyHelper;
+        else
+            settings.apiKeyHelper = managed.previousApiKeyHelper;
+    }
+    if (Object.keys(env).length)
+        settings.env = env;
+    else
+        delete settings.env;
+    delete settings['scalemax.managedBy'];
+    delete settings.scalemax;
+    await backupFile(file, ctx.home);
+    if (Object.keys(settings).length)
+        await atomicWrite(file, JSON.stringify(settings, null, 2) + '\n', 0o600, ctx.platform);
+    else
+        await fs.remove(file);
+    await removeClientSecret(secretPath(ctx.home), ctx);
+    return { id, name, changed: true, path: file, message: 'removed only ScaleMax Claude Code settings and credential' };
+}

package/dist/configure/client-secret.d.ts

@@ -0,0 +1,11 @@
+import { ConfigureContext } from '../types/client.js';
+export declare function writeClientSecret(file: string, ctx: ConfigureContext): Promise<{
+    changed: boolean;
+    backup?: string;
+}>;
+export declare function rollbackClientSecret(file: string, ctx: ConfigureContext, change: {
+    changed: boolean;
+    backup?: string;
+}): Promise<void>;
+export declare function verifyClientSecret(file: string, ctx: ConfigureContext): Promise<void>;
+export declare function removeClientSecret(file: string, ctx: ConfigureContext): Promise<boolean>;

package/dist/configure/client-secret.js

@@ -0,0 +1,47 @@
+import path from 'node:path';
+import fs from 'fs-extra';
+import { sanitizeApiKey } from '../utils/apiKey.js';
+import { atomicWrite, backupFile } from '../utils/fs.js';
+export async function writeClientSecret(file, ctx) {
+    const content = `${sanitizeApiKey(ctx.apiKey)}\n`;
+    const current = await fs.readFile(file, 'utf8').catch(() => '');
+    await fs.ensureDir(path.dirname(file), 0o700);
+    await fs.chmod(path.dirname(file), 0o700).catch(() => undefined);
+    if (current === content) {
+        await fs.chmod(file, 0o600).catch(() => undefined);
+        return { changed: false };
+    }
+    const backup = await backupFile(file, ctx.home);
+    await atomicWrite(file, content, 0o600, ctx.platform);
+    return { changed: true, backup };
+}
+export async function rollbackClientSecret(file, ctx, change) {
+    if (!change.changed)
+        return;
+    if (change.backup) {
+        const previous = await fs.readFile(change.backup, 'utf8');
+        await atomicWrite(file, previous, 0o600, ctx.platform);
+        return;
+    }
+    await fs.remove(file).catch(() => undefined);
+}
+export async function verifyClientSecret(file, ctx) {
+    const content = await fs.readFile(file, 'utf8').catch(() => '');
+    if (sanitizeApiKey(content) !== sanitizeApiKey(ctx.apiKey))
+        throw new Error('ScaleMax client credential is missing or does not match the authenticated key.');
+    if (ctx.platform !== 'win32') {
+        const mode = (await fs.stat(file)).mode & 0o777;
+        if (mode !== 0o600)
+            throw new Error(`ScaleMax client credential permissions are ${mode.toString(8)}; expected 600.`);
+    }
+}
+export async function removeClientSecret(file, ctx) {
+    if (!(await fs.pathExists(file)))
+        return false;
+    const content = await fs.readFile(file, 'utf8').catch(() => '');
+    if (sanitizeApiKey(content) !== sanitizeApiKey(ctx.apiKey))
+        return false;
+    await backupFile(file, ctx.home);
+    await fs.remove(file);
+    return true;
+}

package/dist/configure/common.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import fs from 'fs-extra';
-import { atomicWrite, backupFile, listBackups, readJson } from '../utils/fs.js';
+import JSON5 from 'json5';
+import { atomicWrite, backupFile, listBackups } from '../utils/fs.js';
 import { GENERATED_HEADER } from '../constants.js';
 export function isScaleMaxManagedText(text) {
     return text.includes(GENERATED_HEADER) || text.includes('"scalemax.managedBy"') || text.includes('"managedBy": "ScaleMax CLI generated file"');
@@ -11,6 +12,10 @@ export async function writeManagedConfig(ctx, id, name, file, content) {
         const current = await fs.readFile(file, 'utf8');
         if (!isScaleMaxManagedText(current))
             throw new Error(`Refusing to overwrite unmanaged configuration: ${file}`);
+        if (current === content) {
+            await fs.chmod(file, 0o600).catch(() => undefined);
+            return { id, name, changed: false, path: file, message: 'already current' };
+        }
     }
     const backup = await backupFile(file, ctx.home);
     await atomicWrite(file, content, 0o600, ctx.platform);
@@ -18,9 +23,30 @@ export async function writeManagedConfig(ctx, id, name, file, content) {
 }
 export async function writeMergedJsonConfig(ctx, id, name, file, build) {
     await fs.ensureDir(path.dirname(file));
-    const existing = await readJson(file, {});
+    const current = await fs.readFile(file, 'utf8').catch((error) => {
+        if (error.code === 'ENOENT')
+            return '';
+        throw error;
+    });
+    let existing = {};
+    if (current) {
+        try {
+            const parsed = JSON5.parse(current);
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+                throw new Error('the root value must be an object');
+            existing = parsed;
+        }
+        catch (error) {
+            throw new Error(`Refusing to overwrite invalid JSON/JSON5 configuration at ${file}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    const content = build(existing);
+    if (current === content) {
+        await fs.chmod(file, 0o600).catch(() => undefined);
+        return { id, name, changed: false, path: file, message: 'already current' };
+    }
     const backup = await backupFile(file, ctx.home);
-    await atomicWrite(file, build(existing), 0o600, ctx.platform);
+    await atomicWrite(file, content, 0o600, ctx.platform);
     return { id, name, changed: true, path: file, message: backup ? `configured (backup: ${backup})` : 'configured' };
 }
 async function latestRestorableBackup(file, home) {

package/dist/configure/hermes.d.ts

@@ -1,3 +1,4 @@
 import { ConfigureContext, ConfigureResult } from '../types/client.js';
 export declare function configure(ctx: ConfigureContext): Promise<ConfigureResult>;
+export declare function verify(ctx: ConfigureContext): Promise<ConfigureResult>;
 export declare function remove(ctx: ConfigureContext): Promise<ConfigureResult>;

package/dist/configure/hermes.js

@@ -1,14 +1,165 @@
+import path from 'node:path';
+import fs from 'fs-extra';
+import { parseDocument } from 'yaml';
+import { atomicWrite, backupFile } from '../utils/fs.js';
 import { clientConfigPath } from './paths.js';
-import { writeManagedConfig, removeManagedConfig } from './common.js';
-import { jsonConfig } from './templates.js';
+import { isScaleMaxManagedText } from './common.js';
+import { modelIds, openAiBaseUrl, preferredModel } from './models.js';
 const id = 'hermes';
 const name = 'Hermes';
+const envKey = 'SCALEMAX_HERMES_API_KEY';
+const envMarker = '# ScaleMax managed Hermes API key';
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function envPath(home) { return path.join(home, '.hermes', '.env'); }
+function managedEnv(text, apiKey) {
+    const kept = text.split(/\r?\n/).filter(line => line.trim() !== envMarker && !line.startsWith(`${envKey}=`));
+    while (kept.length && !kept[kept.length - 1])
+        kept.pop();
+    return `${kept.length ? `${kept.join('\n')}\n` : ''}${envMarker}\n${envKey}=${apiKey}\n`;
+}
+function withoutManagedEnv(text) {
+    const kept = text.split(/\r?\n/).filter(line => line.trim() !== envMarker && !line.startsWith(`${envKey}=`));
+    while (kept.length && !kept[kept.length - 1])
+        kept.pop();
+    return kept.length ? `${kept.join('\n')}\n` : '';
+}
+function parseYaml(text) {
+    const doc = parseDocument(text || '{}');
+    if (doc.errors.length)
+        throw new Error(`Hermes config.yaml is invalid: ${doc.errors[0].message}`);
+    if (!doc.contents)
+        doc.contents = doc.createNode({});
+    return doc;
+}
+function modelMetadata(ctx) {
+    return Object.fromEntries(modelIds(ctx).map(modelId => {
+        const model = (ctx.models || []).find(candidate => candidate.id === modelId);
+        const metadata = {};
+        if (model?.context_window)
+            metadata.context_length = model.context_window;
+        return [modelId, metadata];
+    }));
+}
+async function removeLegacyArtifact(ctx) {
+    const legacy = path.join(ctx.home, '.hermes', 'config', 'scalemax.json');
+    if (!(await fs.pathExists(legacy)))
+        return;
+    const text = await fs.readFile(legacy, 'utf8').catch(() => '');
+    if (!isScaleMaxManagedText(text) || !text.includes('api.scalemax.pro'))
+        return;
+    await backupFile(legacy, ctx.home);
+    await fs.remove(legacy);
+}
 export async function configure(ctx) {
     const file = clientConfigPath(id, ctx.home, ctx.platform);
-    const content = jsonConfig(name, ctx.apiKey, ctx.baseUrl);
-    return writeManagedConfig(ctx, id, name, file, content);
+    const secrets = envPath(ctx.home);
+    await fs.ensureDir(path.dirname(file), 0o700);
+    await fs.chmod(path.dirname(file), 0o700).catch(() => undefined);
+    const originalConfig = await fs.readFile(file, 'utf8').catch(() => '');
+    const originalEnv = await fs.readFile(secrets, 'utf8').catch(() => '');
+    const doc = parseYaml(originalConfig);
+    const data = asRecord(doc.toJS());
+    const providers = Array.isArray(data.custom_providers) ? data.custom_providers.filter((provider) => provider?.name !== 'scalemax') : [];
+    providers.push({
+        name: 'scalemax',
+        base_url: openAiBaseUrl(ctx.baseUrl),
+        key_env: envKey,
+        api_mode: 'chat_completions',
+        extra_headers: { 'User-Agent': 'ScaleMax-Hermes/1.0' },
+        max_output_tokens: 4096,
+        models: modelMetadata(ctx)
+    });
+    doc.set('custom_providers', providers);
+    const currentModel = asRecord(data.model);
+    const activatesScaleMax = !currentModel.provider || String(currentModel.provider).startsWith('custom:scalemax');
+    if (activatesScaleMax) {
+        doc.set('model', { ...currentModel, provider: 'custom:scalemax', default: preferredModel(ctx), max_tokens: 4096 });
+    }
+    const nextConfig = String(doc);
+    const nextEnv = managedEnv(originalEnv, ctx.apiKey);
+    if (originalConfig === nextConfig && originalEnv === nextEnv) {
+        await fs.chmod(file, 0o600).catch(() => undefined);
+        await fs.chmod(secrets, 0o600).catch(() => undefined);
+        await removeLegacyArtifact(ctx);
+        return { id, name, changed: false, path: file, message: `already current with ${modelIds(ctx).length} models and a private credential` };
+    }
+    const backups = [await backupFile(file, ctx.home), await backupFile(secrets, ctx.home)].filter(Boolean);
+    try {
+        await atomicWrite(file, nextConfig, 0o600, ctx.platform);
+        await atomicWrite(secrets, nextEnv, 0o600, ctx.platform);
+        await removeLegacyArtifact(ctx);
+    }
+    catch (error) {
+        if (originalConfig)
+            await atomicWrite(file, originalConfig, 0o600, ctx.platform);
+        else
+            await fs.remove(file).catch(() => undefined);
+        if (originalEnv)
+            await atomicWrite(secrets, originalEnv, 0o600, ctx.platform);
+        else
+            await fs.remove(secrets).catch(() => undefined);
+        throw error;
+    }
+    return { id, name, changed: true, path: file, message: `configured named ScaleMax provider with ${modelIds(ctx).length} models${backups.length ? ' (backups created)' : ''}` };
+}
+export async function verify(ctx) {
+    const file = clientConfigPath(id, ctx.home, ctx.platform);
+    const secrets = envPath(ctx.home);
+    const doc = parseYaml(await fs.readFile(file, 'utf8'));
+    const data = asRecord(doc.toJS());
+    const provider = (Array.isArray(data.custom_providers) ? data.custom_providers : []).find((candidate) => candidate?.name === 'scalemax');
+    if (!provider || provider.base_url !== openAiBaseUrl(ctx.baseUrl) || provider.key_env !== envKey || provider.api_mode !== 'chat_completions' || provider.extra_headers?.['User-Agent'] !== 'ScaleMax-Hermes/1.0') {
+        throw new Error('Hermes ScaleMax custom provider settings are incomplete.');
+    }
+    const configured = Object.keys(asRecord(provider.models));
+    const missing = modelIds(ctx).filter(model => !configured.includes(model));
+    const env = await fs.readFile(secrets, 'utf8').catch(() => '');
+    if (missing.length || !env.includes(envMarker) || !env.includes(`${envKey}=${ctx.apiKey}`))
+        throw new Error('Hermes is missing authenticated ScaleMax models or credentials.');
+    if (data?.model?.provider === 'custom:scalemax' && data?.model?.max_tokens !== 4096)
+        throw new Error('Hermes active ScaleMax model must use max_tokens 4096.');
+    return { id, name, changed: false, path: file, message: `verified ${configured.length} ScaleMax models` };
 }
 export async function remove(ctx) {
     const file = clientConfigPath(id, ctx.home, ctx.platform);
-    return removeManagedConfig(ctx, id, name, file);
+    const secrets = envPath(ctx.home);
+    if (!(await fs.pathExists(file)))
+        return { id, name, changed: false, path: file, message: 'no ScaleMax configuration found' };
+    const text = await fs.readFile(file, 'utf8');
+    const doc = parseYaml(text);
+    const data = asRecord(doc.toJS());
+    const providers = Array.isArray(data.custom_providers) ? data.custom_providers : [];
+    const managedProvider = providers.find((provider) => provider?.name === 'scalemax' && provider?.base_url === openAiBaseUrl(ctx.baseUrl));
+    if (!managedProvider)
+        return { id, name, changed: false, path: file, message: 'left unmanaged configuration unchanged' };
+    const managedModels = Object.keys(asRecord(managedProvider.models));
+    const remaining = providers.filter((provider) => provider?.name !== 'scalemax');
+    if (remaining.length)
+        doc.set('custom_providers', remaining);
+    else
+        doc.delete('custom_providers');
+    if (data?.model?.provider === 'custom:scalemax')
+        doc.deleteIn(['model', 'provider']);
+    if (data?.model?.provider === 'custom:scalemax' && managedModels.includes(String(data?.model?.default || '')))
+        doc.deleteIn(['model', 'default']);
+    if (data?.model?.provider === 'custom:scalemax' && data?.model?.max_tokens === 4096)
+        doc.deleteIn(['model', 'max_tokens']);
+    const currentEnv = await fs.readFile(secrets, 'utf8').catch(() => '');
+    await backupFile(file, ctx.home);
+    if (currentEnv)
+        await backupFile(secrets, ctx.home);
+    const nextData = asRecord(doc.toJS());
+    if (Object.keys(nextData).length)
+        await atomicWrite(file, String(doc), 0o600, ctx.platform);
+    else
+        await fs.remove(file);
+    const nextEnv = withoutManagedEnv(currentEnv);
+    if (nextEnv)
+        await atomicWrite(secrets, nextEnv, 0o600, ctx.platform);
+    else
+        await fs.remove(secrets).catch(() => undefined);
+    await removeLegacyArtifact(ctx);
+    return { id, name, changed: true, path: file, message: 'removed only the ScaleMax custom provider and credential' };
 }

package/dist/configure/models.d.ts

@@ -0,0 +1,7 @@
+import { ConfigureContext } from '../types/client.js';
+export declare function modelIds(ctx: ConfigureContext): string[];
+export declare function preferredModel(ctx: ConfigureContext): string;
+export declare function fastModel(ctx: ConfigureContext): string | undefined;
+export declare function modelName(ctx: ConfigureContext, id: string): string;
+export declare function anthropicOrigin(baseUrl: string): string;
+export declare function openAiBaseUrl(baseUrl: string): string;