scalemax 0.1.16 → 0.1.18

package/README.md

@@ -17,6 +17,8 @@ It detects supported AI coding clients, safely backs up existing config files, a
 - A ScaleMax API key
 - Network access to `https://api.scalemax.pro`
 
+The CLI identifies whether the supplied key belongs to the API-credit surface or the token-pack surface. It then stores and configures the matching base URL automatically; users do not need to choose it manually.
+
 ## Installation
 
 ### One-time run with npx
@@ -114,7 +116,7 @@ For clients without a stable official config file, the installer writes a ScaleM
 
 ### Claude Code
 
-ScaleMax updates `~/.claude/settings.json` with `ANTHROPIC_BASE_URL=https://api.scalemax.pro`, gateway model discovery, and a cached `apiKeyHelper` that reads a private `~/.claude/scalemax.key` file. The raw key is not stored in the settings JSON. The Anthropic base URL intentionally has no `/v1` suffix because Claude Code adds `/v1/messages` itself. The CLI preserves unrelated settings, selects a live main model from the authenticated catalog (preferring `claude-opus-4-8`), pins authenticated Haiku for lightweight background work when available, and verifies a one-token Messages request. If verification fails, it removes only the ScaleMax-managed changes. Claude Code picker aliases such as `claude-opus-4-8[1m]` are normalized by the gateway.
+ScaleMax updates `~/.claude/settings.json` with `ANTHROPIC_BASE_URL=https://api.scalemax.pro`, gateway model discovery, and a cached `apiKeyHelper` that reads a private `~/.claude/scalemax.key` file. The raw key is not stored in the settings JSON. The Anthropic base URL intentionally has no `/v1` suffix because Claude Code adds `/v1/messages` itself. The CLI preserves unrelated settings, selects a live main model from the authenticated catalog (preferring `claude-opus-4-8`), pins authenticated Haiku for lightweight background work when available, and sets `CLAUDE_CODE_DISABLE_THINKING=1` because third-party Anthropic-compatible providers do not support Claude Code's proprietary extended-thinking control envelope. It verifies a one-token Messages request and, if verification fails, removes only the ScaleMax-managed changes. Claude Code picker aliases such as `claude-opus-4-8[1m]` are normalized by the gateway.
 
 ### OpenCode
 
@@ -313,4 +315,4 @@ Yes. The CLI uses Windows-aware config paths and writes `%APPDATA%\scalemax\conf
 
 ### What endpoint does it configure?
 
-OpenAI-compatible clients use `https://api.scalemax.pro/v1`. Anthropic-compatible clients such as Claude Code and OpenClaw use the origin `https://api.scalemax.pro`, because those clients append `/v1/messages` themselves.
+API-credit keys use `https://api.scalemax.pro/v1` for OpenAI-compatible clients and `https://api.scalemax.pro` for Anthropic-compatible clients. Token-pack keys use `https://api.scalemax.pro/token/v1` and `https://api.scalemax.pro/token` respectively. The CLI detects the key type and configures the correct surface automatically; the two key types are intentionally not interchangeable.

package/dist/bootstrap.cjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 function cmp(a,b){a=String(a).replace(/^v/,'').split('.').map(Number);b=String(b).split('.').map(Number);for(var i=0;i<3;i++){var d=(a[i]||0)-(b[i]||0);if(d)return d;}return 0;}
-var min='18.17.0';
+var min="18.19.0";
 if (cmp(process.versions.node,min)<0) {
   console.error('ScaleMax requires Node.js >= '+min+'. Current: '+process.versions.node);
   console.error('Install Node.js LTS, then rerun: npx scalemax@latest');

package/dist/commands/configure.js

@@ -18,7 +18,7 @@ export async function printDetected(home = homeDir()) {
     console.log('');
     return detections;
 }
-async function maybeLaunchCodex(chosen, successful) {
+async function maybeLaunchCodex(chosen, successful, baseUrl = SCALEMAX_BASE_URL) {
     if (!chosen.includes('codex') || !successful.has('codex'))
         return;
     console.log(chalk.green('\nConfiguration completed.\n'));
@@ -31,7 +31,7 @@ async function maybeLaunchCodex(chosen, successful) {
         const apiKey = await loadApiKey(homeDir());
         if (!apiKey)
             throw new Error('No API key found.');
-        const result = await codex?.launch?.({ home: homeDir(), platform: process.platform, env: process.env, apiKey, baseUrl: SCALEMAX_BASE_URL });
+        const result = await codex?.launch?.({ home: homeDir(), platform: process.platform, env: process.env, apiKey, baseUrl });
         console.log(chalk.green(`✓ ${result?.message || 'Codex launched.'}`));
     }
     catch (err) {
@@ -61,6 +61,7 @@ export async function configureCommand(opts = {}) {
     if (!keyInfo.models.length)
         throw new Error(keyInfo.error || 'ScaleMax returned no models for this API key. No client configuration was changed.');
     const providerScope = keyInfo.key?.provider_scope || 'both';
+    const selectedBaseUrl = keyInfo.baseUrl || SCALEMAX_BASE_URL;
     const availableClients = clients.filter(c => clientAllowedForModels(c.id, keyInfo.models));
     console.log(chalk.dim(`API key scope: ${scopeHint(providerScope)}. Clients are filtered against the authenticated model catalog.`));
     const detections = await printDetected(home);
@@ -119,7 +120,7 @@ export async function configureCommand(opts = {}) {
         }
         const spinner = ora(`Configuring ${client.name}`).start();
         try {
-            const ctx = { ...baseCtx, apiKey, baseUrl: SCALEMAX_BASE_URL, providerScope, models: keyInfo.models, interactive: Boolean(process.stdin.isTTY), allowAppModification };
+            const ctx = { ...baseCtx, apiKey, baseUrl: selectedBaseUrl, providerScope, models: keyInfo.models, interactive: Boolean(process.stdin.isTTY), allowAppModification };
             const res = await client.configure(ctx);
             spinner.succeed(`${client.name} ${res.message}`);
             if (client.verify) {
@@ -148,7 +149,7 @@ export async function configureCommand(opts = {}) {
         }
     }
     if (opts.promptLaunch !== false && !opts.all && process.stdin.isTTY)
-        await maybeLaunchCodex(chosen, successful);
+        await maybeLaunchCodex(chosen, successful, selectedBaseUrl);
     if (failures.length)
         throw new Error(`${failures.length} client configuration(s) failed:\n${failures.map(f => `- ${f}`).join('\n')}`);
 }

package/dist/commands/doctor.js

@@ -22,7 +22,7 @@ export async function doctorCommand(home = homeDir()) {
             s.succeed(`API reachable, key valid, ${models.length} models loaded`);
             console.log(`${chalk.green('✓')} Usage and key metadata accessible through the authenticated API`);
             const st = ora('Checking streaming (small billable request)').start();
-            const stream = await testStreaming(key, models.find(m => m.id === 'fable-5')?.id || models[0]?.id);
+            const stream = await testStreaming(key, models.find(m => m.id === 'fable-5')?.id || models[0]?.id, res.baseUrl);
             if (stream.ok)
                 st.succeed('Streaming available');
             else {
@@ -49,7 +49,8 @@ export async function doctorCommand(home = homeDir()) {
         }
         if (client.verify && key && models.length) {
             try {
-                const v = await client.verify({ home, platform: process.platform, env: process.env, apiKey: key, baseUrl: SCALEMAX_BASE_URL, models });
+                const checked = await validateApiKey(key);
+                const v = await client.verify({ home, platform: process.platform, env: process.env, apiKey: key, baseUrl: checked.baseUrl || SCALEMAX_BASE_URL, models });
                 console.log(`${chalk.green('✓')} ${client.name} ${v.message}`);
             }
             catch (error) {

package/dist/commands/login.js

@@ -3,7 +3,6 @@ import ora from 'ora';
 import chalk from 'chalk';
 import { validateApiKey } from '../utils/api.js';
 import { saveApiKey } from '../utils/keyStore.js';
-import { SCALEMAX_BASE_URL } from '../constants.js';
 import { homeDir } from '../utils/paths.js';
 import { sanitizeApiKey } from '../utils/apiKey.js';
 export async function loginCommand(home = homeDir()) {
@@ -20,7 +19,7 @@ export async function loginCommand(home = homeDir()) {
         spinner.fail('Invalid API Key');
         throw new Error(result.error || 'Invalid API Key');
     }
-    await saveApiKey(sanitizedKey, SCALEMAX_BASE_URL, home);
+    await saveApiKey(sanitizedKey, result.baseUrl, home);
     spinner.succeed(`API Key verified (${result.key?.provider_scope || 'both'} provider scope)`);
     outro(chalk.green('ScaleMax API key saved.'));
     return sanitizedKey;

package/dist/configure/claude.js

@@ -13,7 +13,8 @@ const name = 'Claude Code';
 const discoveryKey = 'CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY';
 const fastModelKey = 'ANTHROPIC_DEFAULT_HAIKU_MODEL';
 const helperTtlKey = 'CLAUDE_CODE_API_KEY_HELPER_TTL_MS';
-const managedEnvKeys = ['ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_API_KEY', 'ANTHROPIC_BASE_URL', 'ANTHROPIC_MODEL', discoveryKey, fastModelKey, helperTtlKey];
+const disableThinkingKey = 'CLAUDE_CODE_DISABLE_THINKING';
+const managedEnvKeys = ['ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_API_KEY', 'ANTHROPIC_BASE_URL', 'ANTHROPIC_MODEL', discoveryKey, fastModelKey, helperTtlKey, disableThinkingKey];
 function secretPath(home) { return path.join(home, '.claude', 'scalemax.key'); }
 function helperCommand(home, platform) {
     const file = secretPath(home);
@@ -47,7 +48,8 @@ export async function configure(ctx) {
                 ANTHROPIC_BASE_URL: baseUrl,
                 ANTHROPIC_MODEL: model,
                 [discoveryKey]: '1',
-                [helperTtlKey]: '900000'
+                [helperTtlKey]: '900000',
+                [disableThinkingKey]: '1'
             };
             delete nextEnv.ANTHROPIC_AUTH_TOKEN;
             delete nextEnv.ANTHROPIC_API_KEY;
@@ -67,6 +69,7 @@ export async function configure(ctx) {
                     gatewayDiscovery: '1',
                     fastModel: quick || null,
                     helperTtl: '900000',
+                    disableThinking: '1',
                     apiKeyHelper,
                     authTokenSha256: crypto.createHash('sha256').update(ctx.apiKey).digest('hex'),
                     previousEnv,
@@ -86,7 +89,7 @@ export async function verify(ctx) {
     const settings = await fs.readJson(file);
     const env = asRecord(settings?.env);
     const model = String(env.ANTHROPIC_MODEL || '');
-    if (!modelIds(ctx).includes(model) || env.ANTHROPIC_BASE_URL !== anthropicOrigin(ctx.baseUrl) || settings.apiKeyHelper !== helperCommand(ctx.home, ctx.platform) || env.ANTHROPIC_AUTH_TOKEN || env.ANTHROPIC_API_KEY || env[discoveryKey] !== '1') {
+    if (!modelIds(ctx).includes(model) || env.ANTHROPIC_BASE_URL !== anthropicOrigin(ctx.baseUrl) || settings.apiKeyHelper !== helperCommand(ctx.home, ctx.platform) || env.ANTHROPIC_AUTH_TOKEN || env.ANTHROPIC_API_KEY || env[discoveryKey] !== '1' || env[disableThinkingKey] !== '1') {
         throw new Error('Claude Code settings do not match the authenticated ScaleMax model catalog.');
     }
     await verifyClientSecret(secretPath(ctx.home), ctx);
@@ -138,6 +141,8 @@ export async function remove(ctx) {
         restore(fastModelKey);
     if (env[helperTtlKey] === managed.helperTtl)
         restore(helperTtlKey);
+    if (env[disableThinkingKey] === managed.disableThinking)
+        restore(disableThinkingKey);
     if (!Object.prototype.hasOwnProperty.call(env, 'ANTHROPIC_AUTH_TOKEN'))
         restore('ANTHROPIC_AUTH_TOKEN');
     if (!Object.prototype.hasOwnProperty.call(env, 'ANTHROPIC_API_KEY'))

package/dist/constants.d.ts

@@ -1,4 +1,5 @@
 export declare const SCALEMAX_BASE_URL = "https://api.scalemax.pro/v1";
+export declare const SCALEMAX_TOKEN_BASE_URL = "https://api.scalemax.pro/token/v1";
 export declare const APP_NAME = "ScaleMax";
 export declare const GENERATED_HEADER = "ScaleMax managed configuration";
 export declare const KEY_ENV = "SCALEMAX_API_KEY";

package/dist/constants.js

@@ -1,4 +1,5 @@
 export const SCALEMAX_BASE_URL = 'https://api.scalemax.pro/v1';
+export const SCALEMAX_TOKEN_BASE_URL = 'https://api.scalemax.pro/token/v1';
 export const APP_NAME = 'ScaleMax';
 export const GENERATED_HEADER = 'ScaleMax managed configuration';
 export const KEY_ENV = 'SCALEMAX_API_KEY';

package/dist/index.js

@@ -12,7 +12,7 @@ import { modelsCommand } from './commands/models.js';
 import { updateCommand } from './commands/update.js';
 import { removeCommand } from './commands/remove.js';
 import { ensureInstallerApiKey } from './utils/installerConfig.js';
-import { isNodeSupported, nodeUpgradeHint } from './utils/runtime.js';
+import { MIN_NODE, isNodeSupported, nodeUpgradeHint } from './utils/runtime.js';
 import { runSystemAudit } from './utils/systemAudit.js';
 function packageVersion() {
     const here = path.dirname(fileURLToPath(import.meta.url));
@@ -63,7 +63,7 @@ async function runInteractiveInstaller() {
 }
 async function main() {
     if (!isNodeSupported()) {
-        console.error(chalk.red(`ScaleMax requires Node.js >=18.19. Current: ${process.versions.node}`));
+        console.error(chalk.red(`ScaleMax requires Node.js >=${MIN_NODE}. Current: ${process.versions.node}`));
         console.error(nodeUpgradeHint());
         process.exitCode = 1;
         return;

package/dist/utils/api.d.ts

@@ -14,15 +14,18 @@ export interface KeyMetadata {
     prefix?: string;
     label?: string;
 }
-export declare function isAnthropicModel(model: ModelInfo): boolean;
-export declare function filterModelsForScope(models: ModelInfo[], scope: ProviderScope): ModelInfo[];
-export declare function validateApiKey(apiKey: string): Promise<{
+export interface ApiValidation {
     ok: boolean;
     models: ModelInfo[];
     key?: KeyMetadata;
+    baseUrl?: string;
     error?: string;
-}>;
-export declare function testStreaming(apiKey: string, model?: string): Promise<{
+    surfaceMismatch?: boolean;
+}
+export declare function isAnthropicModel(model: ModelInfo): boolean;
+export declare function filterModelsForScope(models: ModelInfo[], scope: ProviderScope): ModelInfo[];
+export declare function validateApiKey(apiKey: string): Promise<ApiValidation>;
+export declare function testStreaming(apiKey: string, model?: string, baseUrl?: string): Promise<{
     ok: boolean;
     error?: string;
 }>;

package/dist/utils/api.js

@@ -1,4 +1,4 @@
-import { SCALEMAX_BASE_URL } from '../constants.js';
+import { SCALEMAX_BASE_URL, SCALEMAX_TOKEN_BASE_URL } from '../constants.js';
 import { redactApiKey, sanitizeApiKey } from './apiKey.js';
 export function isAnthropicModel(model) {
     const provider = String(model.provider || model.owned_by || '').trim().toLowerCase();
@@ -34,7 +34,7 @@ async function friendlyError(res) {
 function retryableStatus(status) {
     return status === 408 || status === 429 || status >= 500;
 }
-async function request(path, apiKey, init = {}, retryGet = false) {
+async function request(path, apiKey, init = {}, retryGet = false, baseUrl = SCALEMAX_BASE_URL) {
     const headers = new Headers(init.headers);
     if (apiKey)
         headers.set('Authorization', `Bearer ${sanitizeApiKey(apiKey)}`);
@@ -47,7 +47,7 @@ async function request(path, apiKey, init = {}, retryGet = false) {
         const timeout = AbortSignal.timeout(15000);
         const signal = init.signal && typeof AbortSignal.any === 'function' ? AbortSignal.any([init.signal, timeout]) : timeout;
         try {
-            const response = await fetch(`${SCALEMAX_BASE_URL}${path}`, { ...init, headers, signal });
+            const response = await fetch(`${baseUrl}${path}`, { ...init, headers, signal });
             if (attempt + 1 === attempts || !retryableStatus(response.status))
                 return response;
             await response.body?.cancel().catch(() => undefined);
@@ -61,14 +61,14 @@ async function request(path, apiKey, init = {}, retryGet = false) {
     }
     throw lastError;
 }
-export async function validateApiKey(apiKey) {
+async function validateOnSurface(apiKey, baseUrl) {
     try {
         const [authCheck, modelsRes] = await Promise.all([
-            request('/usage', apiKey, {}, true),
-            request('/models', apiKey, {}, true)
+            request('/usage', apiKey, {}, true, baseUrl),
+            request('/models', apiKey, {}, true, baseUrl)
         ]);
         if (!authCheck.ok)
-            return { ok: false, models: [], error: redactApiKey(await friendlyError(authCheck), apiKey) };
+            return { ok: false, models: [], error: redactApiKey(await friendlyError(authCheck), apiKey), surfaceMismatch: authCheck.status === 401 };
         const usage = await authCheck.json().catch(() => ({}));
         const keyMeta = { provider_scope: usage?.key?.provider_scope || 'both', mode: usage?.key?.mode, prefix: usage?.key?.prefix, label: usage?.key?.label };
         if (!modelsRes.ok)
@@ -78,17 +78,28 @@ export async function validateApiKey(apiKey) {
         const models = filterModelsForScope(catalog, keyMeta.provider_scope);
         if (!models.length)
             return { ok: false, models: [], key: keyMeta, error: 'ScaleMax returned an empty model catalog.' };
-        return { ok: true, models, key: keyMeta };
+        return { ok: true, models, key: keyMeta, baseUrl };
     }
     catch (err) {
         const message = redactApiKey(err instanceof Error ? err.message : String(err), apiKey);
         return { ok: false, models: [], error: /abort|timeout/i.test(message) ? 'ScaleMax request timed out after 15 seconds.' : message };
     }
 }
-export async function testStreaming(apiKey, model) {
+export async function validateApiKey(apiKey) {
+    const credit = await validateOnSurface(apiKey, SCALEMAX_BASE_URL);
+    if (credit.ok)
+        return credit;
+    if (!credit.surfaceMismatch)
+        return credit;
+    const token = await validateOnSurface(apiKey, SCALEMAX_TOKEN_BASE_URL);
+    if (token.ok)
+        return token;
+    return credit.error && !/Invalid API key|rejected|401/i.test(credit.error) ? credit : token;
+}
+export async function testStreaming(apiKey, model, baseUrl = SCALEMAX_BASE_URL) {
     const selected = model || 'fable-5';
     try {
-        const res = await request('/chat/completions', apiKey, { method: 'POST', body: JSON.stringify({ model: selected, stream: true, max_tokens: 8, messages: [{ role: 'user', content: 'Say OK' }] }) });
+        const res = await request('/chat/completions', apiKey, { method: 'POST', body: JSON.stringify({ model: selected, stream: true, max_tokens: 8, messages: [{ role: 'user', content: 'Say OK' }] }) }, false, baseUrl);
         if (!res.ok)
             return { ok: false, error: redactApiKey(await friendlyError(res), apiKey) };
         const ct = res.headers.get('content-type') || '';

package/dist/utils/installerConfig.js

@@ -1,7 +1,7 @@
 import { intro, outro, password, select, confirm, isCancel, cancel } from '@clack/prompts';
 import chalk from 'chalk';
 import ora from 'ora';
-import { KEY_ENV, SCALEMAX_BASE_URL } from '../constants.js';
+import { KEY_ENV } from '../constants.js';
 import { validateApiKey } from './api.js';
 import { loadApiKey, removeApiKey, saveApiKey } from './keyStore.js';
 import { homeDir } from './paths.js';
@@ -25,7 +25,7 @@ export async function promptForValidatedKey(home, message = 'Enter your ScaleMax
         spinner.fail('Invalid API key');
         throw new Error(result.error || 'Invalid API key');
     }
-    await saveApiKey(candidate, SCALEMAX_BASE_URL, home);
+    await saveApiKey(candidate, result.baseUrl, home);
     spinner.succeed('API key verified and saved');
     return candidate;
 }

package/dist/utils/keyStore.d.ts

@@ -1,3 +1,4 @@
 export declare function saveApiKey(apiKey: string, baseUrl: string, home: string): Promise<void>;
 export declare function loadApiKey(home: string): Promise<string | undefined>;
+export declare function loadBaseUrl(home: string): Promise<string | undefined>;
 export declare function removeApiKey(home: string): Promise<void>;

package/dist/utils/keyStore.js

@@ -13,6 +13,10 @@ export async function loadApiKey(home) {
     const cfg = await readJson(scaleMaxConfigPath(home), {});
     return cfg.apiKey ? sanitizeApiKey(cfg.apiKey) : undefined;
 }
+export async function loadBaseUrl(home) {
+    const cfg = await readJson(scaleMaxConfigPath(home), {});
+    return cfg.baseUrl;
+}
 export async function removeApiKey(home) {
     await fs.remove(scaleMaxConfigPath(home));
 }

package/dist/utils/runtime.d.ts

@@ -1,4 +1,4 @@
-export declare const MIN_NODE = "18.17.0";
+export declare const MIN_NODE = "18.19.0";
 export declare const RECOMMENDED_NODE = "22";
 export type OsFamily = 'macos' | 'ubuntu' | 'debian' | 'fedora' | 'arch' | 'windows' | 'wsl' | 'linux' | 'unknown';
 export type RuntimeAudit = {

package/dist/utils/runtime.js

@@ -1,7 +1,7 @@
 import os from 'node:os';
 import { execa } from 'execa';
 import { commandExists } from './exec.js';
-export const MIN_NODE = '18.17.0';
+export const MIN_NODE = '18.19.0';
 export const RECOMMENDED_NODE = '22';
 export function compareSemver(a, b) { const pa = a.replace(/^v/, '').split('.').map(Number), pb = b.replace(/^v/, '').split('.').map(Number); for (let i = 0; i < 3; i++) {
     const d = (pa[i] || 0) - (pb[i] || 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scalemax",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "Universal ScaleMax installer for AI coding clients",
   "type": "module",
   "bin": {