scalemax 0.1.24 → 0.1.27

package/README.md

@@ -77,6 +77,7 @@ scalemax logout       Remove stored ScaleMax API key
 scalemax doctor       Run diagnostics
 scalemax models       List available ScaleMax models
 scalemax helper-bot   Open the ScaleMax-only support assistant
+scalemax claude-tools Install bounded GitHub skill tools for Claude
 scalemax update       Reconfigure detected clients with the stored key
 scalemax remove       Remove ScaleMax-generated client configuration
 scalemax --help       Show help
@@ -121,6 +122,9 @@ npx scalemax@latest helper-bot --model fable-5 "Help me configure ScaleMax in Cu
 
 Recognized setup, repair, and verification requests execute the CLI's allowlisted client operations directly. Requests such as `setup all providers`, `fix Hermes request failed`, `configure Claude Code`, `verify OpenCode`, and `setup vs code roo extension for claude` are handled by the controller before any model request. The controller detects the relevant client, runs a safe installer when the client has one, verifies existing ScaleMax configuration, repairs ScaleMax-managed files when verification fails, re-verifies, and reports each step.
 
+For Claude tool access, run `scalemax claude-tools`, or ask helper-bot to `install GitHub skill tools for Claude Desktop and Claude Code`. Claude Code receives Anthropic's official `example-skills@anthropic-agent-skills` plugin plus public-GitHub read permissions. Claude Desktop/Cowork receives a local MCP server with only three tools: `github_fetch`, `github_tree`, and `github_install_skill`. The MCP server accepts only public GitHub HTTPS hosts, limits downloads, rejects unsafe archive paths and symlinks, refuses to replace an existing skill, and can write only beneath `~/Claude/skills`. It does not expose a general shell, arbitrary URLs, or unrestricted filesystem access. Restart Claude Desktop after installation and use Cowork or Code; a normal Chat tab does not expose local tools.
+Only install skills from repositories you trust: a `SKILL.md` is instruction content that Claude may follow after installation, even though the bridge itself cannot execute arbitrary repository code.
+
 For Roo Code, helper-bot can install VS Code on Windows with the fixed Microsoft winget package, install the official Roo Code extension, write OpenAI and Claude ScaleMax profiles when the key exposes both families, and verify the import handoff. For general troubleshooting that cannot be completed by a fixed client action, helper-bot sends a small `gpt-5.4` request grounded with bundled ScaleMax documentation about stored authentication, credit/token base URLs, provider scope, client setup, and common errors. The language model never generates or executes shell commands; only fixed ScaleMax client detection, installation, configuration, verification, and rollback operations are available to the controller.
 
 The helper refuses unrelated requests and redacts ScaleMax-style secrets from prompts, provider output, errors, and progress notifications. Use `/status` for non-secret connection details, `/help` for commands, and `/quit` to exit.
@@ -148,7 +152,7 @@ ScaleMax configures the official Codex custom-provider interface in `~/.codex/co
 
 ### Claude Code
 
-ScaleMax updates `~/.claude/settings.json` with `ANTHROPIC_BASE_URL=https://api.scalemax.pro`, gateway model discovery, and a cached `apiKeyHelper` that reads a private `~/.claude/scalemax.key` file. The raw key is not stored in the settings JSON. The Anthropic base URL intentionally has no `/v1` suffix because Claude Code adds `/v1/messages` itself. The CLI preserves unrelated settings, selects a live main model from the authenticated catalog (preferring `claude-opus-4-8`), pins authenticated Haiku for lightweight background work when available, and sets `CLAUDE_CODE_DISABLE_THINKING=1` because third-party Anthropic-compatible providers do not support Claude Code's proprietary extended-thinking control envelope. It verifies a one-token Messages request and, if verification fails, removes only the ScaleMax-managed changes. Claude Code picker aliases such as `claude-opus-4-8[1m]` are normalized by the gateway.
+ScaleMax updates `~/.claude/settings.json` with `ANTHROPIC_BASE_URL=https://api.scalemax.pro`, gateway model discovery, and a cached `apiKeyHelper` that reads a private `~/.claude/scalemax.key` file. The raw key is not stored in the settings JSON. Because Claude Code's gateway discovery only accepts IDs beginning with `claude` or `anthropic`, a catalog that includes Fable also receives a managed `ANTHROPIC_CUSTOM_MODEL_OPTION=fable-5` entry (with a friendly name and description), making `/model fable-5` selectable; any prior custom picker values are restored when ScaleMax configuration is removed. The Anthropic base URL intentionally has no `/v1` suffix because Claude Code adds `/v1/messages` itself. The CLI preserves unrelated settings, selects a live main model from the authenticated catalog (preferring `claude-opus-4-8`), pins authenticated Haiku for lightweight background work when available, and sets `CLAUDE_CODE_DISABLE_THINKING=1` because third-party Anthropic-compatible providers do not support Claude Code's proprietary extended-thinking control envelope. It verifies a one-token Messages request and, if verification fails, removes only the ScaleMax-managed changes. Claude Code picker aliases such as `claude-opus-4-8[1m]` are normalized by the gateway.
 
 ### OpenCode
 

package/dist/assets/claude-github-tools.mjs

@@ -0,0 +1,319 @@
+#!/usr/bin/env node
+
+/**
+ * Least-privilege GitHub MCP bridge installed by ScaleMax for Claude Desktop.
+ *
+ * It exposes no general shell, arbitrary URL, or general filesystem tool. It
+ * can read public GitHub content and install one repository subdirectory that
+ * contains SKILL.md under ~/Claude/skills. Existing skills are never replaced.
+ */
+import { createInterface } from 'node:readline';
+import { promises as fs } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+const MAX_FETCH_BYTES = 512 * 1024;
+const MAX_TREE_BYTES = 2 * 1024 * 1024;
+const MAX_ARCHIVE_BYTES = 32 * 1024 * 1024;
+const MAX_INSTALLED_BYTES = 64 * 1024 * 1024;
+const MAX_INSTALLED_FILES = 2_000;
+const ALLOWED_HOSTS = new Set([
+  'github.com',
+  'raw.githubusercontent.com',
+  'api.github.com',
+  'codeload.github.com',
+  'objects.githubusercontent.com',
+]);
+const SKILLS_ROOT = path.join(os.homedir(), 'Claude', 'skills');
+
+function send(message) {
+  process.stdout.write(`${JSON.stringify(message)}\n`);
+}
+
+function result(id, value) {
+  send({ jsonrpc: '2.0', id, result: value });
+}
+
+function failure(id, code, message) {
+  send({ jsonrpc: '2.0', id, error: { code, message } });
+}
+
+function isSafeRelative(value) {
+  return typeof value === 'string' && value.length > 0 && value.length <= 500 &&
+    !path.posix.isAbsolute(value) && !value.split('/').includes('..') &&
+    !value.split('/').some(part => !part || part === '.') &&
+    !value.includes('\\') && !value.includes('\0');
+}
+
+function validateHost(rawUrl) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw new Error('url must be a valid HTTPS URL');
+  }
+  if (url.protocol !== 'https:' || !ALLOWED_HOSTS.has(url.hostname.toLowerCase())) {
+    throw new Error('only public GitHub HTTPS hosts are allowed');
+  }
+  if (url.username || url.password) throw new Error('credentialed URLs are not allowed');
+  for (const key of url.searchParams.keys()) {
+    if (/(?:token|key|secret|signature|credential|auth)/i.test(key)) {
+      throw new Error('credential-like URL query parameters are not allowed');
+    }
+  }
+  return url;
+}
+
+async function readLimited(response, limit = MAX_FETCH_BYTES) {
+  const length = Number(response.headers.get('content-length') || 0);
+  if (length > limit) throw new Error(`response exceeds ${limit} bytes`);
+  const reader = response.body?.getReader();
+  if (!reader) {
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (bytes.byteLength > limit) throw new Error(`response exceeds ${limit} bytes`);
+    return bytes;
+  }
+  const chunks = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > limit) {
+      await reader.cancel();
+      throw new Error(`response exceeds ${limit} bytes`);
+    }
+    chunks.push(Buffer.from(value));
+  }
+  return Buffer.concat(chunks);
+}
+
+async function fetchBytes(rawUrl, limit = MAX_FETCH_BYTES) {
+  const url = validateHost(rawUrl);
+  const response = await fetch(url, {
+    method: 'GET',
+    redirect: 'error',
+    headers: { 'user-agent': 'ScaleMax-Claude-GitHub-Tools/1.1' },
+  });
+  if (!response.ok) throw new Error(`GitHub returned HTTP ${response.status}`);
+  return { url: url.toString(), response, bytes: await readLimited(response, limit) };
+}
+
+function repoSlug(repo) {
+  if (typeof repo !== 'string' || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repo)) {
+    throw new Error('repo must be in owner/name form');
+  }
+  return repo;
+}
+
+function safeRef(ref = 'main') {
+  if (typeof ref !== 'string' || !/^[A-Za-z0-9._/-]{1,120}$/.test(ref) || ref.includes('..')) {
+    throw new Error('ref contains unsupported characters');
+  }
+  return ref;
+}
+
+async function githubFetch(args) {
+  const maxBytes = Number.isInteger(args?.max_bytes)
+    ? Math.min(Math.max(args.max_bytes, 1), MAX_FETCH_BYTES)
+    : MAX_FETCH_BYTES;
+  const { url, response, bytes } = await fetchBytes(args?.url, maxBytes);
+  const contentType = response.headers.get('content-type') || 'application/octet-stream';
+  const text = /(?:text|json|javascript|xml|yaml)/i.test(contentType)
+    ? bytes.toString('utf8')
+    : `[binary response: ${bytes.byteLength} bytes, ${contentType}]`;
+  return { url, status: response.status, content_type: contentType, bytes: bytes.byteLength, content: text };
+}
+
+async function githubTree(args) {
+  const repo = repoSlug(args?.repo);
+  const ref = safeRef(args?.ref);
+  const encodedRef = ref.split('/').map(encodeURIComponent).join('/');
+  const { bytes } = await fetchBytes(`https://api.github.com/repos/${repo}/git/trees/${encodedRef}?recursive=1`, MAX_TREE_BYTES);
+  const payload = JSON.parse(bytes.toString('utf8'));
+  if (!Array.isArray(payload.tree)) throw new Error('GitHub did not return a repository tree');
+  return {
+    repo,
+    ref,
+    truncated: payload.truncated === true,
+    paths: payload.tree.filter(entry => entry.type === 'blob').map(entry => entry.path).slice(0, 5_000),
+  };
+}
+
+function archiveRoot(entries) {
+  const roots = new Set();
+  for (const entry of entries) {
+    const normalized = entry.replace(/^\.?\//, '');
+    if (normalized.startsWith('/') || normalized.split('/').includes('..') || normalized.includes('\\')) {
+      throw new Error('unsafe archive path rejected');
+    }
+    const root = normalized.split('/')[0];
+    if (!root) throw new Error('invalid archive entry');
+    roots.add(root);
+  }
+  if (roots.size !== 1) throw new Error('unexpected archive layout');
+  return [...roots][0];
+}
+
+async function validateExtractedTree(root) {
+  const pending = [root];
+  let files = 0;
+  let bytes = 0;
+  while (pending.length) {
+    const current = pending.pop();
+    const stat = await fs.lstat(current);
+    if (stat.isSymbolicLink()) throw new Error('skill archives may not contain symbolic links');
+    if (stat.isDirectory()) {
+      for (const name of await fs.readdir(current)) pending.push(path.join(current, name));
+      continue;
+    }
+    if (!stat.isFile()) throw new Error('skill archives may contain only files and directories');
+    files += 1;
+    bytes += stat.size;
+    if (files > MAX_INSTALLED_FILES || bytes > MAX_INSTALLED_BYTES) throw new Error('extracted skill exceeds safety limits');
+  }
+}
+
+async function tarCommand() {
+  const candidates = process.platform === 'win32'
+    ? [path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe')]
+    : ['/usr/bin/tar', '/bin/tar'];
+  for (const candidate of candidates) {
+    try { await fs.access(candidate); return candidate; } catch {}
+  }
+  throw new Error('a system tar utility is required to install a GitHub skill');
+}
+
+async function safeSkillsRoot() {
+  await fs.mkdir(SKILLS_ROOT, { recursive: true, mode: 0o700 });
+  const resolved = await fs.realpath(SKILLS_ROOT);
+  const expected = path.resolve(SKILLS_ROOT);
+  const samePath = process.platform === 'win32'
+    ? resolved.toLowerCase() === expected.toLowerCase()
+    : resolved === expected;
+  if (!samePath) throw new Error('refusing a symlinked Claude skills directory');
+  return resolved;
+}
+
+async function githubInstallSkill(args) {
+  const repo = repoSlug(args?.repo);
+  const ref = safeRef(args?.ref);
+  const skillPath = args?.skill_path || '';
+  if (!isSafeRelative(skillPath)) throw new Error('skill_path must be a non-empty safe relative path');
+  const skillName = path.posix.basename(skillPath);
+  if (!/^[A-Za-z0-9._-]{1,80}$/.test(skillName)) throw new Error('skill directory name is not safe');
+  const skillsRoot = await safeSkillsRoot();
+  const destination = path.join(skillsRoot, skillName);
+  try {
+    await fs.access(destination);
+    throw new Error(`skill already exists at ${destination}; refusing to overwrite`);
+  } catch (error) {
+    if (error?.message?.startsWith('skill already exists')) throw error;
+    if (error?.code !== 'ENOENT') throw error;
+  }
+
+  const encodedRef = ref.split('/').map(encodeURIComponent).join('/');
+  const { bytes } = await fetchBytes(`https://codeload.github.com/${repo}/tar.gz/${encodedRef}`, MAX_ARCHIVE_BYTES);
+  const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'scalemax-skill-'));
+  const archive = path.join(tempRoot, 'repo.tar.gz');
+  const extracted = path.join(tempRoot, 'extracted');
+  try {
+    await fs.writeFile(archive, bytes, { mode: 0o600 });
+    await fs.mkdir(extracted, { mode: 0o700 });
+    const tar = await tarCommand();
+    const verbose = await execFileAsync(tar, ['-tvzf', archive], { maxBuffer: 4 * 1024 * 1024 });
+    for (const line of String(verbose.stdout).split('\n')) {
+      const marker = line.trimStart()[0];
+      if (marker === 'l' || marker === 'h') throw new Error('skill archives may not contain symbolic or hard links');
+    }
+    const listing = await execFileAsync(tar, ['-tzf', archive], { maxBuffer: 4 * 1024 * 1024 });
+    const entries = String(listing.stdout).split('\n').map(value => value.trim()).filter(Boolean);
+    const root = archiveRoot(entries);
+    const normalizedSkillPath = skillPath.replace(/^\/+|\/+$/g, '');
+    const prefix = `${root}/${normalizedSkillPath}`;
+    if (!entries.some(entry => entry.replace(/\/$/, '') === `${prefix}/SKILL.md`)) {
+      throw new Error('requested repository path does not contain SKILL.md');
+    }
+    await execFileAsync(tar, ['-xzf', archive, '-C', extracted, prefix], { maxBuffer: 4 * 1024 * 1024 });
+    const source = path.join(extracted, root, ...normalizedSkillPath.split('/'));
+    await validateExtractedTree(source);
+    const skillFile = path.join(source, 'SKILL.md');
+    if (!(await fs.lstat(skillFile)).isFile()) throw new Error('SKILL.md is not a regular file');
+    try { await fs.rename(source, destination); }
+    catch (error) {
+      if (error?.code !== 'EXDEV') throw error;
+      await fs.cp(source, destination, { recursive: true, force: false, errorOnExist: true });
+      await fs.rm(source, { recursive: true, force: true });
+    }
+    return { repo, ref, skill_path: skillPath, installed_to: destination };
+  } finally {
+    await fs.rm(tempRoot, { recursive: true, force: true }).catch(() => {});
+  }
+}
+
+const tools = [
+  {
+    name: 'github_fetch',
+    description: 'Read public GitHub text or metadata over HTTPS. Only GitHub hosts are permitted; no writes or arbitrary URLs.',
+    inputSchema: { type: 'object', properties: { url: { type: 'string' }, max_bytes: { type: 'integer', minimum: 1, maximum: MAX_FETCH_BYTES } }, required: ['url'] },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+  },
+  {
+    name: 'github_tree',
+    description: 'List public files in a GitHub repository/ref so a skill directory can be selected.',
+    inputSchema: { type: 'object', properties: { repo: { type: 'string' }, ref: { type: 'string' } }, required: ['repo'] },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+  },
+  {
+    name: 'github_install_skill',
+    description: 'Download one public GitHub skill directory containing SKILL.md into ~/Claude/skills. Refuses overwrite and unsafe paths.',
+    inputSchema: { type: 'object', properties: { repo: { type: 'string' }, skill_path: { type: 'string' }, ref: { type: 'string' } }, required: ['repo', 'skill_path'] },
+    annotations: { readOnlyHint: false, openWorldHint: false },
+  },
+];
+
+async function handle(request) {
+  const id = request.id;
+  switch (request.method) {
+    case 'initialize':
+      return result(id, {
+        protocolVersion: request.params?.protocolVersion || '2024-11-05',
+        capabilities: { tools: {} },
+        serverInfo: { name: 'scalemax-github-tools', version: '1.1.0' },
+      });
+    case 'notifications/initialized':
+    case 'notifications/cancelled':
+      return;
+    case 'ping':
+      return result(id, {});
+    case 'tools/list':
+      return result(id, { tools });
+    case 'tools/call': {
+      try {
+        const name = request.params?.name;
+        const args = request.params?.arguments || {};
+        let value;
+        if (name === 'github_fetch') value = await githubFetch(args);
+        else if (name === 'github_tree') value = await githubTree(args);
+        else if (name === 'github_install_skill') value = await githubInstallSkill(args);
+        else throw new Error(`unknown tool: ${name}`);
+        return result(id, { content: [{ type: 'text', text: JSON.stringify(value, null, 2) }], structuredContent: value });
+      } catch (error) {
+        return result(id, { content: [{ type: 'text', text: error instanceof Error ? error.message : String(error) }], isError: true });
+      }
+    }
+    default:
+      return failure(id, -32601, `method not found: ${request.method}`);
+  }
+}
+
+const input = createInterface({ input: process.stdin, crlfDelay: Infinity });
+input.on('line', line => {
+  if (!line.trim()) return;
+  let request;
+  try { request = JSON.parse(line); } catch { return; }
+  Promise.resolve(handle(request)).catch(error => failure(request.id, -32603, error instanceof Error ? error.message : String(error)));
+});

package/dist/commands/claude-tools.d.ts

@@ -0,0 +1 @@
+export declare function claudeToolsCommand(home?: string): Promise<void>;

package/dist/commands/claude-tools.js

@@ -0,0 +1,16 @@
+import chalk from 'chalk';
+import { installClaudeGithubTools } from '../configure/claude-tools.js';
+import { homeDir } from '../utils/paths.js';
+export async function claudeToolsCommand(home = homeDir()) {
+    console.log(chalk.dim('Installing bounded public-GitHub tools for Claude Desktop/Cowork and Claude Code…'));
+    const result = await installClaudeGithubTools('both', home, process.platform, process.env);
+    if (result.desktop) {
+        console.log(chalk.green(`✓ Claude Desktop MCP verified (${result.desktop.configPaths.length} config${result.desktop.configPaths.length === 1 ? '' : 's'}).`));
+        console.log(chalk.dim(`  Tools: github_fetch, github_tree, github_install_skill · destination: ~/Claude/skills`));
+    }
+    if (result.code?.installed)
+        console.log(chalk.green(`✓ Claude Code ${result.code.message}.`));
+    else if (result.code)
+        console.log(chalk.yellow(`! ${result.code.message}`));
+    console.log(chalk.dim('No general shell, arbitrary URL, or unrestricted filesystem tool was granted. Restart Claude Desktop before using the new MCP tools.'));
+}

package/dist/commands/helper-bot.js

@@ -10,6 +10,7 @@ import { loadApiKey } from '../utils/keyStore.js';
 import { homeDir } from '../utils/paths.js';
 import { validateApiKey } from '../utils/api.js';
 import { commandExists } from '../utils/exec.js';
+import { installClaudeGithubTools } from '../configure/claude-tools.js';
 export const SCALEMAX_HELPER_REFUSAL = `I am the official ScaleMax Helper.
 
 I can only assist with installing, configuring, repairing, verifying, and troubleshooting ScaleMax.
@@ -542,6 +543,7 @@ const SCALEMAX_TOPIC_PATTERN = /\b(?:scalemax|api\s*key|stored\s+key|customer\s+
 const TROUBLESHOOTING_PATTERN = /\b(?:error|failed?|failure|broken|not\s+working|doesn['’]?t\s+work|cannot|can['’]?t|timeout|invalid|unauthorized|forbidden|help)\b/i;
 const GREETING_PATTERN = /^(?:hi|hello|hey|help|what can you do)[!.?\s]*$/i;
 const CLAUDE_DESKTOP_PATTERN = /\bclaude\s+desktop\b/i;
+const CLAUDE_GITHUB_TOOLS_PATTERN = /\b(?:github|skills?|mcp|tools?|download)\b/i;
 const CLAUDE_DESKTOP_CONFIGURATION_PATTERN = /\b(?:configur(?:e|ation)|setup|set\s*up|gateway|base\s*url|api\s*key|connect(?:ion)?|third[- ]party|inference|field|install|verify)\b/i;
 const CODEX_CLI_PATTERN = /\bcodex(?:\s+cli)?\b/i;
 const CLIENT_CONFIGURATION_PATTERN = /\b(?:configur(?:e|ation)|setup|set\s*up|base\s*url|api\s*key|connect(?:ion)?|provider|install|repair|verify|update)\b/i;
@@ -770,6 +772,10 @@ const HELPER_CLIENT_PATTERNS = [
     { id: 'claude', pattern: /\bclaude(?:\s+code|\s+cli)?\b/i }
 ];
 function helperActionKind(question) {
+    if (CLAUDE_GITHUB_TOOLS_PATTERN.test(question) && /\b(?:cannot|can['’]?t|unable|not\s+(?:able|being\s+able)|doesn['’]?t\s+have|no\s+tools?)\b/i.test(question))
+        return 'repair';
+    if (CLAUDE_GITHUB_TOOLS_PATTERN.test(question) && /\b(?:enable|grant|provide|add)\b/i.test(question))
+        return 'configure';
     if (/\b(?:repair|fix|troubleshoot|diagnose|not\s+working|doesn['’]?t\s+work|broken|failed?|invalid|timeout|rate\s*limit(?:ed)?)\b/i.test(question))
         return 'repair';
     if (HELPER_MUTATION_PATTERN.test(question))
@@ -779,6 +785,8 @@ function helperActionKind(question) {
     return undefined;
 }
 function helperActionTarget(question) {
+    if (/\bclaude\b/i.test(question) && CLAUDE_GITHUB_TOOLS_PATTERN.test(question))
+        return 'claude-tools';
     if (CLAUDE_DESKTOP_PATTERN.test(question))
         return undefined;
     if (ALL_CLIENTS_PATTERN.test(question) || /\b(?:all|every)\b.{0,30}\bproviders?\b/i.test(question))
@@ -982,6 +990,29 @@ export async function executeHelperAction(question, connection, home, clientCata
     const target = helperActionTarget(cleanQuestion);
     if (!kind || !target)
         return undefined;
+    if (target === 'claude-tools') {
+        const toolTarget = CLAUDE_DESKTOP_PATTERN.test(cleanQuestion)
+            ? 'desktop'
+            : /\bclaude\s+(?:code|cli|terminal)\b/i.test(cleanQuestion) ? 'code' : 'both';
+        write(`✓ Stored ${helperBillingMode(connection)} key is authenticated; secrets remain hidden.`);
+        write(`→ ${kind === 'verify' ? 'Verifying and reconciling' : 'Installing'} bounded public-GitHub tools for ${toolTarget === 'both' ? 'Claude Desktop/Cowork and Claude Code' : toolTarget === 'desktop' ? 'Claude Desktop/Cowork' : 'Claude Code'}…`);
+        const tools = await installClaudeGithubTools(toolTarget, home, connection.platform || process.platform, process.env);
+        const completed = [];
+        if (tools.desktop) {
+            completed.push(`Claude Desktop MCP exposes github_fetch, github_tree, and github_install_skill; installs are confined to ~/Claude/skills`);
+            write('✓ Claude Desktop GitHub MCP process and tool catalog verified.');
+        }
+        if (tools.code?.installed) {
+            completed.push(`Claude Code ${tools.code.message}`);
+            write(`✓ Claude Code ${tools.code.message}.`);
+        }
+        else if (tools.code) {
+            write(`! ${tools.code.message}`);
+        }
+        if (!completed.length)
+            throw new Error('Claude Desktop and Claude Code were not detected, so no GitHub tools were installed.');
+        return `✅ Successfully completed: ${completed.join('; ')}. Restart Claude Desktop before using the new MCP tools. No unrestricted shell or filesystem access was granted.`;
+    }
     const scope = requestedProviderScope(cleanQuestion, target);
     const scopedModels = actionModels(connection, scope);
     const selected = target === 'all'

package/dist/commands/helper-docs.js

@@ -29,6 +29,12 @@ export const HELPER_DOC_SECTIONS = [
         keywords: ['codex', 'cursor', 'claude code', 'opencode', 'openclaw', 'hermes', 'cherry studio', 'update', 'doctor'],
         content: `scalemax update detects supported clients and configures them from the stored key. scalemax doctor validates the stored key and performs a minimal ScaleMax request. Supported clients include Codex CLI, Cursor, Claude Code, OpenCode, OpenClaw, Hermes, Cherry Studio, Roo Code, and API Code. Recognized helper-bot setup and verification requests are executed by the CLI controller before any model fallback is used.`
     },
+    {
+        id: 'claude-github-tools',
+        title: 'Claude GitHub skills and tools',
+        keywords: ['claude desktop', 'claude code', 'github', 'skill', 'skills', 'tool', 'tools', 'mcp', 'download'],
+        content: `Run scalemax claude-tools, or ask helper-bot to install GitHub skill tools for Claude. Claude Code receives Anthropic's official example-skills plugin and bounded public-GitHub read permissions. Claude Desktop and Cowork receive the ScaleMax GitHub MCP with github_fetch, github_tree, and github_install_skill. That MCP accepts only public GitHub HTTPS hosts, refuses overwrite, and installs only beneath ~/Claude/skills; it exposes no general shell or unrestricted filesystem. Restart Claude Desktop after setup and use Cowork or Code because the normal Chat tab does not expose local tools.`
+    },
     {
         id: 'troubleshooting',
         title: 'Common troubleshooting',

package/dist/configure/claude-tools.d.ts

@@ -0,0 +1,34 @@
+interface CommandResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    all: string;
+}
+export type ClaudeToolsRunner = (command: string, args: string[], options: {
+    env: NodeJS.ProcessEnv;
+    input?: string;
+}) => Promise<CommandResult>;
+export interface ClaudeDesktopToolsResult {
+    scriptPath: string;
+    configPaths: string[];
+    managedConfigPaths: string[];
+    changed: boolean;
+}
+export interface ClaudeCodeToolsResult {
+    installed: boolean;
+    changed: boolean;
+    settingsPath?: string;
+    message: string;
+}
+export interface ClaudeToolsResult {
+    desktop?: ClaudeDesktopToolsResult;
+    code?: ClaudeCodeToolsResult;
+}
+export declare function claudeDesktopConfigPath(root: string): string;
+export declare function claudeGithubToolPath(home: string): string;
+/** Install and verify the bounded public-GitHub MCP server for Claude Desktop/Cowork. */
+export declare function installClaudeDesktopGithubTools(home: string, platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv, runner?: ClaudeToolsRunner, nodePath?: string, assetPath?: string): Promise<ClaudeDesktopToolsResult>;
+/** Install Anthropic's official skills plugin and safe GitHub-read permissions for Claude Code. */
+export declare function installClaudeCodeGithubSkills(home: string, platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv, runner?: ClaudeToolsRunner): Promise<ClaudeCodeToolsResult>;
+export declare function installClaudeGithubTools(target: 'desktop' | 'code' | 'both', home: string, platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv, runner?: ClaudeToolsRunner): Promise<ClaudeToolsResult>;
+export {};

package/dist/configure/claude-tools.js

@@ -0,0 +1,283 @@
+import fs from 'fs-extra';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { execa } from 'execa';
+import { atomicWrite, backupFile } from '../utils/fs.js';
+import { configRoot } from '../utils/paths.js';
+const MCP_SERVER_NAME = 'scalemax-github';
+const MCP_ASSET = fileURLToPath(new URL('../assets/claude-github-tools.mjs', import.meta.url));
+const CLAUDE_SKILLS_REPO = 'anthropics/skills';
+const CLAUDE_SKILLS_MARKETPLACE = 'anthropic-agent-skills';
+const CLAUDE_SKILLS_PLUGIN = 'example-skills@anthropic-agent-skills';
+const CODE_GITHUB_PERMISSIONS = [
+    'Bash(git ls-remote https://github.com/*)',
+    'WebFetch(domain:github.com)',
+    'WebFetch(domain:raw.githubusercontent.com)',
+];
+const defaultRunner = async (command, args, options) => {
+    const result = await execa(command, args, {
+        env: options.env,
+        input: options.input,
+        all: true,
+        reject: false,
+    });
+    return {
+        exitCode: result.exitCode ?? 1,
+        stdout: result.stdout || '',
+        stderr: result.stderr || '',
+        all: result.all || '',
+    };
+};
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function desktopConfigRoots(home, platform, env) {
+    const root = configRoot(home, platform, env);
+    return [path.join(root, 'Claude'), path.join(root, 'Claude-3p')];
+}
+export function claudeDesktopConfigPath(root) {
+    return path.join(root, 'claude_desktop_config.json');
+}
+export function claudeGithubToolPath(home) {
+    return path.join(home, '.scalemax', 'claude-github-tools.mjs');
+}
+async function existingDesktopRoots(home, platform, env) {
+    const roots = desktopConfigRoots(home, platform, env);
+    const existing = [];
+    for (const root of roots)
+        if (await fs.pathExists(root))
+            existing.push(root);
+    // A fresh install should use Claude's standard documented config location.
+    return existing.length ? existing : [roots[0]];
+}
+async function parseJsonObject(file) {
+    if (!(await fs.pathExists(file)))
+        return {};
+    let value;
+    try {
+        value = await fs.readJson(file);
+    }
+    catch (error) {
+        throw new Error(`Refusing to overwrite invalid Claude JSON at ${file}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`Refusing to overwrite non-object Claude JSON at ${file}.`);
+    return value;
+}
+function isExpectedServer(value, nodePath, scriptPath) {
+    const server = asRecord(value);
+    return server.command === nodePath && Array.isArray(server.args) && server.args.length === 1 && server.args[0] === scriptPath;
+}
+function isUpgradeSafeServer(value, scriptPath) {
+    const server = asRecord(value);
+    if (!Array.isArray(server.args) || server.args.length !== 1 || server.args[0] !== scriptPath || typeof server.command !== 'string')
+        return false;
+    return /^node(?:\.exe)?$/i.test(path.basename(server.command));
+}
+async function stableNodeCommand(nodePath, env, platform) {
+    const delimiter = platform === 'win32' ? ';' : ':';
+    const executable = platform === 'win32' ? 'node.exe' : 'node';
+    const expected = await fs.realpath(nodePath).catch(() => nodePath);
+    for (const directory of (env.PATH || env.Path || env.path || '').split(delimiter).filter(Boolean)) {
+        const candidate = path.join(directory, executable);
+        const resolved = await fs.realpath(candidate).catch(() => undefined);
+        if (resolved === expected)
+            return candidate;
+    }
+    return nodePath;
+}
+function isScaleMaxManagedGateway(value) {
+    if (value.inferenceProvider !== 'gateway' || typeof value.inferenceGatewayBaseUrl !== 'string')
+        return false;
+    try {
+        const hostname = new URL(value.inferenceGatewayBaseUrl).hostname.toLowerCase();
+        return hostname === 'api.scalemax.pro' || hostname.endsWith('.scalemax.pro');
+    }
+    catch {
+        return false;
+    }
+}
+async function managedThirdPartyConfigs(roots) {
+    const files = [];
+    for (const root of roots) {
+        const library = path.join(root, 'configLibrary');
+        if (!(await fs.pathExists(library)))
+            continue;
+        for (const name of await fs.readdir(library)) {
+            if (/^[A-Za-z0-9._-]+\.json$/i.test(name))
+                files.push(path.join(library, name));
+        }
+    }
+    return files;
+}
+async function verifyMcpProcess(scriptPath, nodePath, env, runner) {
+    const input = [
+        JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'scalemax-cli', version: '1' } } }),
+        JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} }),
+        '',
+    ].join('\n');
+    const probe = await runner(nodePath, [scriptPath], { env, input });
+    if (probe.exitCode !== 0)
+        throw new Error(`Claude GitHub MCP verification failed: ${probe.all.trim() || `Node exited with ${probe.exitCode}`}`);
+    const responses = probe.stdout.split(/\r?\n/).filter(Boolean).map(line => {
+        try {
+            return JSON.parse(line);
+        }
+        catch {
+            return undefined;
+        }
+    }).filter(Boolean);
+    const names = responses.find(response => response.id === 2)?.result?.tools?.map((tool) => tool.name) || [];
+    for (const expected of ['github_fetch', 'github_tree', 'github_install_skill']) {
+        if (!names.includes(expected))
+            throw new Error(`Claude GitHub MCP verification did not expose ${expected}.`);
+    }
+}
+/** Install and verify the bounded public-GitHub MCP server for Claude Desktop/Cowork. */
+export async function installClaudeDesktopGithubTools(home, platform = process.platform, env = process.env, runner = defaultRunner, nodePath = process.execPath, assetPath = MCP_ASSET) {
+    const roots = await existingDesktopRoots(home, platform, env);
+    const configPaths = roots.map(claudeDesktopConfigPath);
+    const scriptPath = claudeGithubToolPath(home);
+    const nodeCommand = await stableNodeCommand(nodePath, env, platform);
+    const source = await fs.readFile(assetPath, 'utf8');
+    const configs = [];
+    for (const file of configPaths) {
+        const current = await parseJsonObject(file);
+        const servers = asRecord(current.mcpServers);
+        if (servers[MCP_SERVER_NAME] !== undefined && !isExpectedServer(servers[MCP_SERVER_NAME], nodeCommand, scriptPath) && !isUpgradeSafeServer(servers[MCP_SERVER_NAME], scriptPath)) {
+            throw new Error(`Refusing to replace an unmanaged ${MCP_SERVER_NAME} MCP server in ${file}.`);
+        }
+        configs.push({
+            file,
+            current,
+            next: {
+                ...current,
+                mcpServers: {
+                    ...servers,
+                    [MCP_SERVER_NAME]: { command: nodeCommand, args: [scriptPath] },
+                },
+            },
+        });
+    }
+    const managedConfigs = [];
+    for (const file of await managedThirdPartyConfigs(roots)) {
+        const current = await parseJsonObject(file);
+        if (!isScaleMaxManagedGateway(current))
+            continue;
+        managedConfigs.push({ file, current, next: { ...current, isLocalDevMcpEnabled: true, toolSearchEnabled: true } });
+    }
+    const oldScript = await fs.readFile(scriptPath, 'utf8').catch(() => undefined);
+    const written = [];
+    let changed = oldScript !== source;
+    try {
+        await atomicWrite(scriptPath, source, 0o700, platform);
+        await fs.chmod(scriptPath, 0o700).catch(() => undefined);
+        // Verify the protocol with the caller's normal environment. Claude Desktop
+        // launches the server with the signed-in user's OS home; forcing HOME here
+        // can change platform DNS/proxy behavior and is unnecessary for tools/list.
+        await verifyMcpProcess(scriptPath, nodeCommand, env, runner);
+        for (const item of [...configs, ...managedConfigs]) {
+            const previous = await fs.readFile(item.file, 'utf8').catch(() => undefined);
+            const next = JSON.stringify(item.next, null, 2) + '\n';
+            if (previous === next)
+                continue;
+            changed = true;
+            await backupFile(item.file, home);
+            await atomicWrite(item.file, next, 0o600, platform);
+            written.push({ file: item.file, previous });
+        }
+    }
+    catch (error) {
+        for (const item of written.reverse()) {
+            if (item.previous === undefined)
+                await fs.remove(item.file).catch(() => undefined);
+            else
+                await atomicWrite(item.file, item.previous, 0o600, platform).catch(() => undefined);
+        }
+        if (oldScript === undefined)
+            await fs.remove(scriptPath).catch(() => undefined);
+        else
+            await atomicWrite(scriptPath, oldScript, 0o700, platform).catch(() => undefined);
+        throw error;
+    }
+    return {
+        scriptPath,
+        configPaths,
+        managedConfigPaths: managedConfigs.map(item => item.file),
+        changed,
+    };
+}
+function parseJsonArray(text) {
+    try {
+        const value = JSON.parse(text);
+        return Array.isArray(value) ? value : [];
+    }
+    catch {
+        return [];
+    }
+}
+async function writeClaudeCodeGithubPermissions(home, platform) {
+    const file = path.join(home, '.claude', 'settings.local.json');
+    const current = await parseJsonObject(file);
+    const permissions = asRecord(current.permissions);
+    const allow = Array.isArray(permissions.allow) ? [...permissions.allow] : [];
+    const nextAllow = [...allow];
+    for (const permission of CODE_GITHUB_PERMISSIONS)
+        if (!nextAllow.includes(permission))
+            nextAllow.push(permission);
+    const next = { ...current, permissions: { ...permissions, allow: nextAllow } };
+    const content = JSON.stringify(next, null, 2) + '\n';
+    const existing = await fs.readFile(file, 'utf8').catch(() => undefined);
+    if (existing === content)
+        return { file, changed: false };
+    await backupFile(file, home);
+    await atomicWrite(file, content, 0o600, platform);
+    return { file, changed: true };
+}
+/** Install Anthropic's official skills plugin and safe GitHub-read permissions for Claude Code. */
+export async function installClaudeCodeGithubSkills(home, platform = process.platform, env = process.env, runner = defaultRunner) {
+    const commandEnv = { ...env, HOME: home, USERPROFILE: home };
+    const version = await runner('claude', ['--version'], { env: commandEnv });
+    if (version.exitCode !== 0)
+        return { installed: false, changed: false, message: 'Claude Code was not detected; Desktop tools can still be used.' };
+    const permission = await writeClaudeCodeGithubPermissions(home, platform);
+    const marketplaces = await runner('claude', ['plugin', 'marketplace', 'list', '--json'], { env: commandEnv });
+    if (marketplaces.exitCode !== 0)
+        throw new Error(`Unable to inspect Claude plugin marketplaces: ${marketplaces.all.trim() || 'Claude returned an error.'}`);
+    const marketplaceInstalled = parseJsonArray(marketplaces.stdout).some(item => item?.repo === CLAUDE_SKILLS_REPO || item?.name === CLAUDE_SKILLS_MARKETPLACE);
+    let changed = permission.changed;
+    if (!marketplaceInstalled) {
+        const add = await runner('claude', ['plugin', 'marketplace', 'add', CLAUDE_SKILLS_REPO], { env: commandEnv });
+        if (add.exitCode !== 0)
+            throw new Error(`Unable to add Anthropic's skills marketplace: ${add.all.trim() || 'Claude returned an error.'}`);
+        changed = true;
+    }
+    const before = await runner('claude', ['plugin', 'list', '--json'], { env: commandEnv });
+    if (before.exitCode !== 0)
+        throw new Error(`Unable to inspect Claude plugins: ${before.all.trim() || 'Claude returned an error.'}`);
+    const pluginInstalled = parseJsonArray(before.stdout).some(item => item?.id === CLAUDE_SKILLS_PLUGIN && item?.enabled !== false);
+    if (!pluginInstalled) {
+        const install = await runner('claude', ['plugin', 'install', CLAUDE_SKILLS_PLUGIN], { env: commandEnv });
+        if (install.exitCode !== 0)
+            throw new Error(`Unable to install Anthropic's skills plugin: ${install.all.trim() || 'Claude returned an error.'}`);
+        changed = true;
+    }
+    const after = await runner('claude', ['plugin', 'list', '--json'], { env: commandEnv });
+    const verified = after.exitCode === 0 && parseJsonArray(after.stdout).some(item => item?.id === CLAUDE_SKILLS_PLUGIN && item?.enabled !== false);
+    if (!verified)
+        throw new Error(`Claude Code did not report ${CLAUDE_SKILLS_PLUGIN} as enabled after installation.`);
+    return {
+        installed: true,
+        changed,
+        settingsPath: permission.file,
+        message: `verified ${CLAUDE_SKILLS_PLUGIN} and bounded public-GitHub read permissions`,
+    };
+}
+export async function installClaudeGithubTools(target, home, platform = process.platform, env = process.env, runner = defaultRunner) {
+    const result = {};
+    if (target === 'desktop' || target === 'both')
+        result.desktop = await installClaudeDesktopGithubTools(home, platform, env, runner);
+    if (target === 'code' || target === 'both')
+        result.code = await installClaudeCodeGithubSkills(home, platform, env, runner);
+    return result;
+}

package/dist/configure/claude.js

@@ -14,7 +14,30 @@ const discoveryKey = 'CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY';
 const fastModelKey = 'ANTHROPIC_DEFAULT_HAIKU_MODEL';
 const helperTtlKey = 'CLAUDE_CODE_API_KEY_HELPER_TTL_MS';
 const disableThinkingKey = 'CLAUDE_CODE_DISABLE_THINKING';
-const managedEnvKeys = ['ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_API_KEY', 'ANTHROPIC_BASE_URL', 'ANTHROPIC_MODEL', discoveryKey, fastModelKey, helperTtlKey, disableThinkingKey];
+// Claude Code's gateway discovery intentionally ignores model IDs that do not
+// start with `claude` or `anthropic`. Fable's public ScaleMax ID is
+// deliberately `fable-5`, so keep it selectable with the supported custom
+// picker entry as well as the normal discovery feed.
+const customModelOptionKey = 'ANTHROPIC_CUSTOM_MODEL_OPTION';
+const customModelOptionNameKey = 'ANTHROPIC_CUSTOM_MODEL_OPTION_NAME';
+const customModelOptionDescriptionKey = 'ANTHROPIC_CUSTOM_MODEL_OPTION_DESCRIPTION';
+const fableModelId = 'fable-5';
+const fableModelName = 'Fable 5';
+const fableModelDescription = 'Fable 5 via ScaleMax';
+const verificationTimeoutMs = 60_000;
+const managedEnvKeys = [
+    'ANTHROPIC_AUTH_TOKEN',
+    'ANTHROPIC_API_KEY',
+    'ANTHROPIC_BASE_URL',
+    'ANTHROPIC_MODEL',
+    customModelOptionKey,
+    customModelOptionNameKey,
+    customModelOptionDescriptionKey,
+    discoveryKey,
+    fastModelKey,
+    helperTtlKey,
+    disableThinkingKey
+];
 function secretPath(home) { return path.join(home, '.claude', 'scalemax.key'); }
 function helperCommand(home, platform) {
     const file = secretPath(home);
@@ -25,10 +48,17 @@ function helperCommand(home, platform) {
 function asRecord(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
+function hasFableModel(ctx) {
+    return (ctx.models || []).some(model => {
+        const id = String(model.id || '').trim().toLowerCase();
+        return id === fableModelId || id === 'claude-fable-5';
+    });
+}
 export async function configure(ctx) {
     const file = clientConfigPath(id, ctx.home, ctx.platform);
     const model = preferredModel(ctx);
     const quick = fastModel(ctx);
+    const fable = hasFableModel(ctx);
     const baseUrl = anthropicOrigin(ctx.baseUrl);
     const apiKeyHelper = helperCommand(ctx.home, ctx.platform);
     const secret = await writeClientSecret(secretPath(ctx.home), ctx);
@@ -51,6 +81,25 @@ export async function configure(ctx) {
                 [helperTtlKey]: '900000',
                 [disableThinkingKey]: '1'
             };
+            if (fable) {
+                // This is a public model ID, not an upstream/provider alias. Claude
+                // Code's custom option bypasses its `claude*` discovery filter while
+                // still sending exactly `fable-5` to the configured gateway.
+                nextEnv[customModelOptionKey] = fableModelId;
+                nextEnv[customModelOptionNameKey] = fableModelName;
+                nextEnv[customModelOptionDescriptionKey] = fableModelDescription;
+            }
+            else if (oldMetadata.managedBy === 'ScaleMax CLI') {
+                // A key can be reconfigured from a Fable-enabled catalog to one that
+                // does not include Fable. Remove only the values this CLI previously
+                // managed, restoring any user values captured on the first configure.
+                for (const key of [customModelOptionKey, customModelOptionNameKey, customModelOptionDescriptionKey]) {
+                    if (Object.prototype.hasOwnProperty.call(previousEnv, key))
+                        nextEnv[key] = previousEnv[key];
+                    else if (nextEnv[key] === fableModelId || nextEnv[key] === fableModelName || nextEnv[key] === fableModelDescription)
+                        delete nextEnv[key];
+                }
+            }
             delete nextEnv.ANTHROPIC_AUTH_TOKEN;
             delete nextEnv.ANTHROPIC_API_KEY;
             if (quick)
@@ -70,6 +119,9 @@ export async function configure(ctx) {
                     fastModel: quick || null,
                     helperTtl: '900000',
                     disableThinking: '1',
+                    customModelOption: fable ? fableModelId : null,
+                    customModelOptionName: fable ? fableModelName : null,
+                    customModelOptionDescription: fable ? fableModelDescription : null,
                     apiKeyHelper,
                     authTokenSha256: crypto.createHash('sha256').update(ctx.apiKey).digest('hex'),
                     previousEnv,
@@ -89,18 +141,29 @@ export async function verify(ctx) {
     const settings = await fs.readJson(file);
     const env = asRecord(settings?.env);
     const model = String(env.ANTHROPIC_MODEL || '');
-    if (!modelIds(ctx).includes(model) || env.ANTHROPIC_BASE_URL !== anthropicOrigin(ctx.baseUrl) || settings.apiKeyHelper !== helperCommand(ctx.home, ctx.platform) || env.ANTHROPIC_AUTH_TOKEN || env.ANTHROPIC_API_KEY || env[discoveryKey] !== '1' || env[disableThinkingKey] !== '1') {
+    const fable = hasFableModel(ctx);
+    const customModelMatches = !fable
+        || (env[customModelOptionKey] === fableModelId
+            && env[customModelOptionNameKey] === fableModelName
+            && env[customModelOptionDescriptionKey] === fableModelDescription);
+    if (!modelIds(ctx).includes(model) || !customModelMatches || env.ANTHROPIC_BASE_URL !== anthropicOrigin(ctx.baseUrl) || settings.apiKeyHelper !== helperCommand(ctx.home, ctx.platform) || env.ANTHROPIC_AUTH_TOKEN || env.ANTHROPIC_API_KEY || env[discoveryKey] !== '1' || env[disableThinkingKey] !== '1') {
         throw new Error('Claude Code settings do not match the authenticated ScaleMax model catalog.');
     }
     await verifyClientSecret(secretPath(ctx.home), ctx);
     const quick = fastModel(ctx);
     if (quick && env[fastModelKey] !== quick)
         throw new Error('Claude Code background model does not match the fastest authenticated model.');
+    // Verification proves that the authenticated Messages route works; it does
+    // not need to warm the user's slower default Opus model.  Prefer Haiku when
+    // it is present, while keeping ANTHROPIC_MODEL unchanged for real sessions.
+    // The longer fallback timeout also prevents a healthy Opus-only catalog
+    // from being rolled back merely because first-token latency exceeds 15s.
+    const verificationModel = quick || model;
     const response = await fetch(`${anthropicOrigin(ctx.baseUrl)}/v1/messages`, {
         method: 'POST',
         headers: { Authorization: `Bearer ${ctx.apiKey}`, 'anthropic-version': '2023-06-01', 'content-type': 'application/json' },
-        body: JSON.stringify({ model, max_tokens: 1, stream: false, messages: [{ role: 'user', content: 'K' }] }),
-        signal: AbortSignal.timeout(15000)
+        body: JSON.stringify({ model: verificationModel, max_tokens: 1, stream: false, messages: [{ role: 'user', content: 'K' }] }),
+        signal: AbortSignal.timeout(verificationTimeoutMs)
     });
     if (!response.ok) {
         let message = `HTTP ${response.status}`;
@@ -111,7 +174,15 @@ export async function verify(ctx) {
         catch { }
         throw new Error(`Claude Messages verification failed: ${redactApiKey(message, ctx.apiKey)}`);
     }
-    return { id, name, changed: false, path: file, message: `verified Anthropic Messages with ${model}` };
+    return {
+        id,
+        name,
+        changed: false,
+        path: file,
+        message: verificationModel === model
+            ? `verified Anthropic Messages with ${model}`
+            : `verified Anthropic Messages with ${verificationModel}; default model remains ${model}`,
+    };
 }
 export async function remove(ctx) {
     const file = clientConfigPath(id, ctx.home, ctx.platform);
@@ -143,6 +214,12 @@ export async function remove(ctx) {
         restore(helperTtlKey);
     if (env[disableThinkingKey] === managed.disableThinking)
         restore(disableThinkingKey);
+    if (env[customModelOptionKey] === managed.customModelOption)
+        restore(customModelOptionKey);
+    if (env[customModelOptionNameKey] === managed.customModelOptionName)
+        restore(customModelOptionNameKey);
+    if (env[customModelOptionDescriptionKey] === managed.customModelOptionDescription)
+        restore(customModelOptionDescriptionKey);
     if (!Object.prototype.hasOwnProperty.call(env, 'ANTHROPIC_AUTH_TOKEN'))
         restore('ANTHROPIC_AUTH_TOKEN');
     if (!Object.prototype.hasOwnProperty.call(env, 'ANTHROPIC_API_KEY'))

package/dist/configure/models.js

@@ -14,7 +14,6 @@ const preferredOpenAi = [
     'gpt-5.4',
     'gpt-5.4-mini',
     'gpt-5.3-codex',
-    'fable-5',
     'codex-auto-review'
 ];
 export function modelIds(ctx) {

package/dist/configure/templates.js

@@ -11,7 +11,7 @@ export function jsonConfig(client, apiKey, baseUrl, extra = {}) {
     }, null, 2) + '\n';
 }
 export function continueConfig(apiKey, baseUrl) {
-    const models = ['fable-5', 'gpt-5.6-sol', 'gpt-5.6-luna', 'gpt-5.6-terra', 'gpt-5.5', 'gpt-5.4', 'gpt-5.4-mini', 'gpt-5.3-codex', 'codex-auto-review'];
+    const models = ['gpt-5.6-sol', 'gpt-5.6-luna', 'gpt-5.6-terra', 'gpt-5.5', 'gpt-5.4', 'gpt-5.4-mini', 'gpt-5.3-codex', 'codex-auto-review'];
     return JSON.stringify({
         models: models.map(model => ({
             title: `ScaleMax ${model}`,

package/dist/configure/trae-solo.js

@@ -5,7 +5,7 @@ const id = 'trae-solo';
 const name = 'TRAE SOLO';
 export async function configure(ctx) {
     const file = clientConfigPath(id, ctx.home, ctx.platform);
-    const content = jsonConfig(name, '$SCALEMAX_API_KEY', ctx.baseUrl, { "officialSetup": ["Settings > Models > Add Model", "API format: OpenAI Chat Completions", `Request URL: ${ctx.baseUrl}/chat/completions or base URL ${ctx.baseUrl}`, "Use only a model ID returned by the authenticated catalog"], "recommendedModel": "fable-5" });
+    const content = jsonConfig(name, '$SCALEMAX_API_KEY', ctx.baseUrl, { "officialSetup": ["Settings > Models > Add Model", "API format: OpenAI Chat Completions", `Request URL: ${ctx.baseUrl}/chat/completions or base URL ${ctx.baseUrl}`, "Use only a model ID returned by the authenticated catalog"], "recommendedModel": "gpt-5.4-mini" });
     const result = await writeManagedConfig(ctx, id, name, file, content);
     return { ...result, message: 'setup guide written; enter these values in TRAE SOLO custom model settings' };
 }

package/dist/index.js

@@ -12,6 +12,7 @@ import { modelsCommand } from './commands/models.js';
 import { updateCommand } from './commands/update.js';
 import { removeCommand } from './commands/remove.js';
 import { helperBotCommand } from './commands/helper-bot.js';
+import { claudeToolsCommand } from './commands/claude-tools.js';
 import { ensureInstallerApiKey } from './utils/installerConfig.js';
 import { MIN_NODE, isNodeSupported, nodeUpgradeHint } from './utils/runtime.js';
 import { runSystemAudit } from './utils/systemAudit.js';
@@ -37,7 +38,7 @@ function printHelp(command) {
         console.log('Usage: scalemax helper-bot [--model <id>] ["question"]\n\nExecute safe ScaleMax setup and verification actions, or open the ScaleMax-only troubleshooting assistant.');
         return;
     }
-    const details = { update: 'Revalidate the API key and reconfigure every detected client.', remove: 'Restore backups or remove only ScaleMax-managed client configuration.', doctor: 'Validate the API key and verify detected client configuration.', models: 'List models available to the stored API key.', login: 'Store or replace the ScaleMax API key.', logout: 'Remove the locally stored ScaleMax API key.' };
+    const details = { update: 'Revalidate the API key and reconfigure every detected client.', remove: 'Restore backups or remove only ScaleMax-managed client configuration.', doctor: 'Validate the API key and verify detected client configuration.', models: 'List models available to the stored API key.', login: 'Store or replace the ScaleMax API key.', logout: 'Remove the locally stored ScaleMax API key.', 'claude-tools': 'Install and verify bounded public-GitHub skill tools for Claude Desktop/Cowork and Claude Code.' };
     if (command && details[command]) {
         console.log(`Usage: scalemax ${command}\n\n${details[command]}`);
         return;
@@ -53,6 +54,7 @@ Commands:
   scalemax doctor     Run diagnostics
   scalemax models     List available models
   scalemax helper-bot Execute setup actions or open the ScaleMax Helper
+  scalemax claude-tools Install bounded GitHub skill tools for Claude
   scalemax update     Reconfigure detected clients
   scalemax remove     Remove ScaleMax-generated configs
   scalemax --version  Show installed version
@@ -106,6 +108,9 @@ async function main() {
             case 'helper-bot':
                 await helperBotCommand(args);
                 break;
+            case 'claude-tools':
+                await claudeToolsCommand();
+                break;
             case 'update':
                 await updateCommand();
                 break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scalemax",
-  "version": "0.1.24",
+  "version": "0.1.27",
   "description": "Universal ScaleMax installer for AI coding clients",
   "type": "module",
   "bin": {