scalemax 0.1.28 → 0.1.30

package/README.md

@@ -125,7 +125,7 @@ Recognized setup, repair, and verification requests execute the CLI's allowliste
 For Claude tool access, run `scalemax claude-tools`, or ask helper-bot to `install GitHub skill tools for Claude Desktop and Claude Code`. Claude Code receives Anthropic's official `example-skills@anthropic-agent-skills` plugin plus public-GitHub read permissions. Claude Desktop/Cowork receives a local MCP server with only three tools: `github_fetch`, `github_tree`, and `github_install_skill`. The MCP server accepts only public GitHub HTTPS hosts, limits downloads, rejects unsafe archive paths and symlinks, refuses to replace an existing skill, and can write only beneath `~/Claude/skills`. It does not expose a general shell, arbitrary URLs, or unrestricted filesystem access. Restart Claude Desktop after installation and use Cowork or Code; a normal Chat tab does not expose local tools.
 Only install skills from repositories you trust: a `SKILL.md` is instruction content that Claude may follow after installation, even though the bridge itself cannot execute arbitrary repository code.
 
-For Roo Code, helper-bot can install VS Code on Windows with the fixed Microsoft winget package, install the official Roo Code extension, write OpenAI and Claude ScaleMax profiles when the key exposes those families, and verify the import handoff. For DeepSeek V4 Flash, helper-bot installs and configures Continue's Chat/Edit integration instead because the Azure deployment has no tool calling. For general troubleshooting that cannot be completed by a fixed client action, helper-bot sends a small `gpt-5.4` request grounded with bundled ScaleMax documentation about stored authentication, credit/token base URLs, provider scope, client setup, and common errors. The language model never generates or executes shell commands; only fixed ScaleMax client detection, installation, configuration, verification, and rollback operations are available to the controller.
+For Roo Code, helper-bot can install VS Code on Windows with the fixed Microsoft winget package, install the official Roo Code extension, write OpenAI and Claude ScaleMax profiles when the key exposes those families, and verify the import handoff. For DeepSeek V4 Flash, helper-bot creates an agent profile only when authenticated discovery reports `capabilities.tools=true`; otherwise it installs Continue's safe Chat/Edit fallback. For general troubleshooting that cannot be completed by a fixed client action, helper-bot sends a small `gpt-5.4` request grounded with bundled ScaleMax documentation about stored authentication, credit/token base URLs, provider scope, client setup, and common errors. The language model never generates or executes shell commands; only fixed ScaleMax client detection, installation, configuration, verification, and rollback operations are available to the controller.
 
 The helper refuses unrelated requests and redacts ScaleMax-style secrets from prompts, provider output, errors, and progress notifications. Use `/status` for non-secret connection details, `/help` for commands, and `/quit` to exit.
 
@@ -153,7 +153,7 @@ ScaleMax configures the official Codex custom-provider interface in `~/.codex/co
 
 ### Claude Code
 
-ScaleMax updates `~/.claude/settings.json` with `ANTHROPIC_BASE_URL=https://api.scalemax.pro`, gateway model discovery, and a cached `apiKeyHelper` that reads a private `~/.claude/scalemax.key` file. The raw key is not stored in the settings JSON. Because Claude Code's gateway discovery only accepts IDs beginning with `claude` or `anthropic`, a catalog that includes Fable also receives a managed `ANTHROPIC_CUSTOM_MODEL_OPTION=fable-5` entry (with a friendly name and description), making `/model fable-5` selectable; any prior custom picker values are restored when ScaleMax configuration is removed. The Anthropic base URL intentionally has no `/v1` suffix because Claude Code adds `/v1/messages` itself. The CLI preserves unrelated settings, selects a live main model from the authenticated catalog (preferring `claude-opus-4-8`), pins authenticated Haiku for lightweight background work when available, and sets `CLAUDE_CODE_DISABLE_THINKING=1` because third-party Anthropic-compatible providers do not support Claude Code's proprietary extended-thinking control envelope. It verifies a one-token Messages request and, if verification fails, removes only the ScaleMax-managed changes. Claude Code picker aliases such as `claude-opus-4-8[1m]` are normalized by the gateway.
+ScaleMax updates `~/.claude/settings.json` with `ANTHROPIC_BASE_URL=https://api.scalemax.pro`, gateway model discovery, and a cached `apiKeyHelper` that reads a private `~/.claude/scalemax.key` file. The raw key is not stored in the settings JSON. Because Claude Code's gateway discovery only accepts IDs beginning with `claude` or `anthropic`, a catalog that includes Fable also receives a managed `ANTHROPIC_CUSTOM_MODEL_OPTION=fable-5` entry (with a friendly name and description), making `/model fable-5` selectable; any prior custom picker values are restored when ScaleMax configuration is removed. The Anthropic base URL intentionally has no `/v1` suffix because Claude Code adds `/v1/messages` itself. The CLI preserves unrelated settings, selects a live main model from the authenticated catalog (preferring `claude-opus-5`), pins authenticated Haiku for lightweight background work when available, and sets `CLAUDE_CODE_DISABLE_THINKING=1` because third-party Anthropic-compatible providers do not support Claude Code's proprietary extended-thinking control envelope. The ScaleMax gateway separately locks supported Claude-family requests to provider-side `low` effort, including Fable's translated route; clients cannot raise that setting. Haiku 4.5 omits the unsupported effort field. It verifies a one-token Messages request and, if verification fails, removes only the ScaleMax-managed changes. Claude Code picker aliases such as `claude-opus-5[1m]` are normalized by the gateway.
 
 ### OpenCode
 
@@ -161,19 +161,19 @@ ScaleMax merges a named `scalemax` provider into `~/.config/opencode/opencode.js
 
 ### OpenClaw
 
-ScaleMax partitions OpenClaw models into native `openai-responses` (`scalemax-codex`, `/v1`), OpenAI-compatible `openai-completions` (`scalemax-deepseek`, `/v1`), and `anthropic-messages` (`scalemax-claude`, origin) providers. `deepseek-v4-flash` is isolated in the Chat Completions provider with tools disabled; it is never advertised through Responses. The API key and compatibility User-Agent are OpenClaw file-backed SecretRefs stored in private `0600` files under `~/.openclaw/secrets/`; neither value is embedded in the main provider JSON. Migration removes the obsolete mixed provider, preserves the active model family, and scrubs plaintext credentials from generated ScaleMax agent registries even when they contain an older key. Output is capped at 4096 tokens, private-network routing is denied for the public gateway, and unrelated providers and agent settings are preserved.
+ScaleMax partitions OpenClaw models into native `openai-responses` (`scalemax-codex`, `/v1`), OpenAI-compatible `openai-completions` (`scalemax-deepseek`, `/v1`), and `anthropic-messages` (`scalemax-claude`, origin) providers. `deepseek-v4-flash` is always isolated in the Chat Completions provider and never advertised through Responses. Its agent flags come from authenticated catalog discovery: the official route enables tools, reasoning effort, streaming usage, and mandatory `reasoning_content` replay while disabling unsupported thinking-mode `tool_choice`; a fallback route remains explicitly tool-free. The API key and compatibility User-Agent are OpenClaw file-backed SecretRefs stored in private `0600` files under `~/.openclaw/secrets/`; neither value is embedded in the main provider JSON. Migration removes the obsolete mixed provider, preserves the active model family, and scrubs plaintext credentials from generated ScaleMax agent registries even when they contain an older key. Output is capped at 4096 tokens, private-network routing is denied for the public gateway, and unrelated providers and agent settings are preserved.
 
 ### Hermes
 
-ScaleMax creates family-specific Hermes providers in `~/.hermes/config.yaml` and stores one credential in `~/.hermes/.env` with private permissions. `scalemax-codex` uses Hermes's `codex_responses` transport at `/v1`; `scalemax-claude` uses `anthropic_messages` at the gateway origin. Both use a scoped `ScaleMax-Hermes/1.0` user agent and a 4096-token output cap. Existing non-ScaleMax providers and defaults are preserved, and the obsolete mixed provider is migrated safely.
+ScaleMax creates family-specific Hermes providers in `~/.hermes/config.yaml` and stores one credential in `~/.hermes/.env` with private permissions. `scalemax-codex` uses Hermes's `codex_responses` transport at `/v1`; `scalemax-claude` uses `anthropic_messages` at the gateway origin; and an authenticated tool-capable `deepseek-v4-flash` route receives a separate `scalemax-deepseek` Chat Completions provider. A text-only DeepSeek route fails closed for Hermes agent mode. All providers use a scoped `ScaleMax-Hermes/1.0` user agent and a 4096-token output cap. Existing non-ScaleMax providers and defaults are preserved, and the obsolete mixed provider is migrated safely.
 
 ### Roo Code (VS Code)
 
-Roo Code stores provider profiles and secrets in VS Code extension storage, so ScaleMax does not mutate its private database. Instead, the CLI writes a private `0600` Roo settings-import file at `~/.scalemax/roo-code-import.json` and points the supported `roo-cline.autoImportSettingsPath` VS Code setting at it. Codex and Claude profiles remain separate. DeepSeek V4 Flash is deliberately not offered in Roo because Roo's task-completion loop requires tool calling and this Azure deployment does not expose it. Reload VS Code once so Roo imports supported profiles into its SecretStorage. CLI verification intentionally reports the handoff as verified, not the extension runtime, until that reload occurs.
+Roo Code stores provider profiles and secrets in VS Code extension storage, so ScaleMax does not mutate its private database. Instead, the CLI writes a private `0600` Roo settings-import file at `~/.scalemax/roo-code-import.json` and points the supported `roo-cline.autoImportSettingsPath` VS Code setting at it. Codex, Claude, and tool-capable DeepSeek profiles remain separate. DeepSeek is offered only when authenticated discovery reports `capabilities.tools=true`; otherwise Roo fails closed and points the user to Continue Chat/Edit. Reload VS Code once so Roo imports supported profiles into its SecretStorage. CLI verification intentionally reports the handoff as verified, not the extension runtime, until that reload occurs.
 
 ### Continue (VS Code)
 
-Continue is the supported VS Code route for `deepseek-v4-flash`. The CLI installs the official `Continue.continue` extension when VS Code is available, merges a Chat/Edit-only OpenAI-compatible model into `~/.continue/config.yaml`, sets `useResponsesApi: false`, and keeps the authenticated ScaleMax key in private `~/.continue/.env` rather than the YAML. Existing Continue models and environment entries are preserved. Reload VS Code, select **ScaleMax DeepSeek V4 Flash**, and use Chat or Edit; Agent mode is unavailable because the deployment does not expose tool calling.
+Continue is the universal VS Code Chat/Edit route for `deepseek-v4-flash`. The CLI installs the official `Continue.continue` extension when VS Code is available, merges an OpenAI-compatible model into `~/.continue/config.yaml`, sets `useResponsesApi: false`, and keeps the authenticated ScaleMax key in private `~/.continue/.env` rather than the YAML. Existing Continue models and environment entries are preserved. Reload VS Code and select **ScaleMax DeepSeek V4 Flash**. For agent workflows, prefer Roo/OpenClaw/Hermes when the authenticated catalog reports `capabilities.tools=true`.
 
 ### Cursor BYOK routing on macOS
 

package/dist/commands/helper-docs.js

@@ -15,19 +15,19 @@ export const HELPER_DOC_SECTIONS = [
         id: 'provider-scope',
         title: 'Provider scope and visible models',
         keywords: ['provider', 'scope', 'openai', 'claude', 'anthropic', 'deepseek', 'both', 'models', 'fable'],
-        content: `A ScaleMax key may be OpenAI only, Claude only, both, or the exact-model DeepSeek V4 Flash entitlement. OpenAI-only keys should configure OpenAI-compatible models only. Claude-only keys should configure Claude-compatible models only. Both-scope keys may configure both model families in clients that can switch profiles. Fable 5 is a Claude-family frontend model through ScaleMax and should only appear for Claude-capable or both-scope keys, not OpenAI-only keys. A DeepSeek V4 Flash key discovers only deepseek-v4-flash; broad OpenAI and both scopes do not inherit that entitlement. The model uses the OpenAI-compatible /v1/chat/completions route with streaming and max_tokens; it must not be placed on a Responses route or advertised as tool-capable.`
+        content: `A ScaleMax key may be OpenAI only, Claude only, both, or the exact-model DeepSeek V4 Flash entitlement. OpenAI-only keys should configure OpenAI-compatible models only. Claude-only keys should configure Claude-compatible models only. Both-scope keys may configure both model families in clients that can switch profiles. Fable 5 is a Claude-family frontend model through ScaleMax and should only appear for Claude-capable or both-scope keys, not OpenAI-only keys. A DeepSeek V4 Flash key discovers only deepseek-v4-flash; broad OpenAI and both scopes do not inherit that entitlement. The model always uses the OpenAI-compatible /v1/chat/completions route with streaming and max_tokens, never Responses. Tool support is route-dependent: trust capabilities.tools from the authenticated catalog. The official route exposes thinking-mode tools and reasoning_content replay; a fallback route may remain text-only.`
     },
     {
         id: 'roo-code',
         title: 'Roo Code setup through VS Code',
         keywords: ['roo', 'roo code', 'vscode', 'vs code', 'extension', 'visual studio code', 'deepseek'],
-        content: `For Roo Code, the ScaleMax CLI writes a private settings import file at ~/.scalemax/roo-code-import.json and sets roo-cline.autoImportSettingsPath in VS Code User settings. Roo imports that profile after VS Code is reloaded. Roo is not offered for a DeepSeek V4 Flash-only key because Roo's task loop requires tool calling and this Azure deployment does not expose it; use Continue Chat/Edit instead. The CLI can install the official Roo Code extension with code --install-extension RooVeterinaryInc.roo-cline when VS Code is detected. On Windows, helper-bot may install VS Code first with winget using the fixed Microsoft.VisualStudioCode package id, then install Roo, write the import handoff, and verify the files.`
+        content: `For Roo Code, the ScaleMax CLI writes a private settings import file at ~/.scalemax/roo-code-import.json and sets roo-cline.autoImportSettingsPath in VS Code User settings. Roo imports that profile after VS Code is reloaded. A DeepSeek V4 Flash profile is offered only when the authenticated catalog reports capabilities.tools=true. If the active route is text-only, Roo fails closed because its task loop requires tools and the helper recommends Continue Chat/Edit instead. The CLI can install the official Roo Code extension with code --install-extension RooVeterinaryInc.roo-cline when VS Code is detected. On Windows, helper-bot may install VS Code first with winget using the fixed Microsoft.VisualStudioCode package id, then install Roo, write the import handoff, and verify the files.`
     },
     {
         id: 'continue-deepseek',
         title: 'Continue setup for DeepSeek V4 Flash',
         keywords: ['continue', 'continue dev', 'vscode', 'vs code', 'extension', 'deepseek', 'deepseek-v4-flash'],
-        content: `Continue is the supported VS Code integration for DeepSeek V4 Flash. scalemax update installs the official Continue extension when VS Code is available, writes a private ~/.continue/config.yaml Chat/Edit profile, stores the authenticated ScaleMax key in private ~/.continue/.env, and forces useResponsesApi: false. Reload VS Code after setup. Do not use Agent mode and do not request or configure a DeepSeek, Azure, or other upstream credential.`
+        content: `Continue is the universal Chat/Edit integration for DeepSeek V4 Flash. scalemax update installs the official Continue extension when VS Code is available, writes a private ~/.continue/config.yaml Chat/Edit profile, stores the authenticated ScaleMax key in private ~/.continue/.env, and forces useResponsesApi: false. Reload VS Code after setup. Agent clients such as Roo, OpenClaw, and Hermes are configured only when authenticated discovery reports capabilities.tools=true. Never request or configure an upstream credential on the customer device.`
     },
     {
         id: 'codex-and-clients',

package/dist/commands/login.js

@@ -16,8 +16,8 @@ export async function loginCommand(home = homeDir()) {
     const spinner = ora('Verifying API key').start();
     const result = await validateApiKey(sanitizedKey);
     if (!result.ok) {
-        spinner.fail('Invalid API Key');
-        throw new Error(result.error || 'Invalid API Key');
+        spinner.fail('Could not verify API key');
+        throw new Error(result.error || 'Could not verify API key');
     }
     await saveApiKey(sanitizedKey, result.baseUrl, home);
     spinner.succeed(`API Key verified (${result.key?.provider_scope || 'both'} provider scope)`);

package/dist/configure/hermes.js

@@ -4,13 +4,14 @@ import { parseDocument } from 'yaml';
 import { atomicWrite, backupFile } from '../utils/fs.js';
 import { clientConfigPath } from './paths.js';
 import { isScaleMaxManagedText } from './common.js';
-import { anthropicModelIds, anthropicOrigin, openAiBaseUrl, openAiResponsesModelIds, preferredAnthropicModel, preferredOpenAiResponsesModel } from './models.js';
+import { anthropicModelIds, anthropicOrigin, deepSeekChatModelIds, modelSupportsTools, openAiBaseUrl, openAiResponsesModelIds, preferredAnthropicModel, preferredOpenAiResponsesModel } from './models.js';
 const id = 'hermes';
 const name = 'Hermes';
 const envKey = 'SCALEMAX_HERMES_API_KEY';
 const envMarker = '# ScaleMax managed Hermes API key';
 const legacyProviderName = 'scalemax';
 const codexProviderName = 'scalemax-codex';
+const deepSeekProviderName = 'scalemax-deepseek';
 const claudeProviderName = 'scalemax-claude';
 function asRecord(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
@@ -45,6 +46,9 @@ function modelMetadata(ctx, ids) {
         return [modelId, metadata];
     }));
 }
+function toolCapableDeepSeekModelIds(ctx) {
+    return deepSeekChatModelIds(ctx).filter(model => modelSupportsTools(ctx, model));
+}
 async function removeLegacyArtifact(ctx) {
     const legacy = path.join(ctx.home, '.hermes', 'config', 'scalemax.json');
     if (!(await fs.pathExists(legacy)))
@@ -65,8 +69,13 @@ export async function configure(ctx) {
     const doc = parseYaml(originalConfig);
     const data = asRecord(doc.toJS());
     const codexIds = openAiResponsesModelIds(ctx);
+    const discoveredDeepSeekIds = deepSeekChatModelIds(ctx);
+    const deepSeekIds = toolCapableDeepSeekModelIds(ctx);
     const claudeIds = anthropicModelIds(ctx);
-    const managedNames = new Set([legacyProviderName, codexProviderName, claudeProviderName]);
+    if (ctx.providerScope === 'deepseek-v4-flash' && discoveredDeepSeekIds.length && !deepSeekIds.length) {
+        throw new Error('Hermes agent mode requires tool calling, but the active DeepSeek V4 Flash route is text-only. Configure the official tool-capable route first. No configuration was changed.');
+    }
+    const managedNames = new Set([legacyProviderName, codexProviderName, deepSeekProviderName, claudeProviderName]);
     const providers = Array.isArray(data.custom_providers) ? data.custom_providers.filter((provider) => !managedNames.has(provider?.name)) : [];
     if (codexIds.length)
         providers.push({
@@ -78,6 +87,16 @@ export async function configure(ctx) {
             max_output_tokens: 4096,
             models: modelMetadata(ctx, codexIds)
         });
+    if (deepSeekIds.length)
+        providers.push({
+            name: deepSeekProviderName,
+            base_url: openAiBaseUrl(ctx.baseUrl),
+            key_env: envKey,
+            api_mode: 'chat_completions',
+            extra_headers: { 'User-Agent': 'ScaleMax-Hermes/1.0' },
+            max_output_tokens: 4096,
+            models: modelMetadata(ctx, deepSeekIds)
+        });
     if (claudeIds.length)
         providers.push({
             name: claudeProviderName,
@@ -94,8 +113,17 @@ export async function configure(ctx) {
     const activatesScaleMax = !currentProvider || currentProvider.startsWith('custom:scalemax');
     if (activatesScaleMax) {
         const keepClaude = currentProvider === `custom:${claudeProviderName}` || claudeIds.includes(String(currentModel.default || ''));
-        const activeName = codexIds.length && !keepClaude ? codexProviderName : claudeProviderName;
-        const activeModel = activeName === codexProviderName ? preferredOpenAiResponsesModel(ctx) : preferredAnthropicModel(ctx);
+        const keepDeepSeek = currentProvider === `custom:${deepSeekProviderName}`
+            || deepSeekIds.includes(String(currentModel.default || ''))
+            || (!codexIds.length && !claudeIds.length && deepSeekIds.length > 0);
+        const activeName = keepDeepSeek
+            ? deepSeekProviderName
+            : codexIds.length && !keepClaude
+                ? codexProviderName
+                : claudeIds.length ? claudeProviderName : deepSeekProviderName;
+        const activeModel = activeName === codexProviderName
+            ? preferredOpenAiResponsesModel(ctx)
+            : activeName === deepSeekProviderName ? deepSeekIds[0] : preferredAnthropicModel(ctx);
         doc.set('model', { ...currentModel, provider: `custom:${activeName}`, default: activeModel, max_tokens: 4096 });
     }
     const nextConfig = String(doc);
@@ -104,7 +132,7 @@ export async function configure(ctx) {
         await fs.chmod(file, 0o600).catch(() => undefined);
         await fs.chmod(secrets, 0o600).catch(() => undefined);
         await removeLegacyArtifact(ctx);
-        return { id, name, changed: false, path: file, message: `already current with ${codexIds.length} Codex/OpenAI and ${claudeIds.length} Claude models and a private credential` };
+        return { id, name, changed: false, path: file, message: `already current with ${codexIds.length} Codex/OpenAI, ${deepSeekIds.length} DeepSeek, and ${claudeIds.length} Claude models and a private credential` };
     }
     const backups = [await backupFile(file, ctx.home), await backupFile(secrets, ctx.home)].filter(Boolean);
     try {
@@ -123,7 +151,7 @@ export async function configure(ctx) {
             await fs.remove(secrets).catch(() => undefined);
         throw error;
     }
-    return { id, name, changed: true, path: file, message: `configured family-specific ScaleMax providers with ${codexIds.length} Codex/OpenAI and ${claudeIds.length} Claude models${backups.length ? ' (backups created)' : ''}` };
+    return { id, name, changed: true, path: file, message: `configured family-specific ScaleMax providers with ${codexIds.length} Codex/OpenAI, ${deepSeekIds.length} DeepSeek, and ${claudeIds.length} Claude models${backups.length ? ' (backups created)' : ''}` };
 }
 export async function verify(ctx) {
     const file = clientConfigPath(id, ctx.home, ctx.platform);
@@ -132,8 +160,10 @@ export async function verify(ctx) {
     const data = asRecord(doc.toJS());
     const providers = Array.isArray(data.custom_providers) ? data.custom_providers : [];
     const codexIds = openAiResponsesModelIds(ctx);
+    const deepSeekIds = toolCapableDeepSeekModelIds(ctx);
     const claudeIds = anthropicModelIds(ctx);
     const codex = providers.find((candidate) => candidate?.name === codexProviderName);
+    const deepSeek = providers.find((candidate) => candidate?.name === deepSeekProviderName);
     const claude = providers.find((candidate) => candidate?.name === claudeProviderName);
     const valid = (provider, baseUrl, apiMode, ids) => provider
         && provider.base_url === baseUrl && provider.key_env === envKey && provider.api_mode === apiMode
@@ -141,6 +171,7 @@ export async function verify(ctx) {
         && Object.keys(asRecord(provider.models)).length === ids.length
         && ids.every(model => Object.hasOwn(asRecord(provider.models), model));
     if ((codexIds.length ? !valid(codex, openAiBaseUrl(ctx.baseUrl), 'codex_responses', codexIds) : Boolean(codex))
+        || (deepSeekIds.length ? !valid(deepSeek, openAiBaseUrl(ctx.baseUrl), 'chat_completions', deepSeekIds) : Boolean(deepSeek))
         || (claudeIds.length ? !valid(claude, anthropicOrigin(ctx.baseUrl), 'anthropic_messages', claudeIds) : Boolean(claude))) {
         throw new Error('Hermes ScaleMax family-specific custom provider settings are incomplete.');
     }
@@ -149,7 +180,7 @@ export async function verify(ctx) {
         throw new Error('Hermes is missing authenticated ScaleMax models or credentials.');
     if (String(data?.model?.provider || '').startsWith('custom:scalemax') && data?.model?.max_tokens !== 4096)
         throw new Error('Hermes active ScaleMax model must use max_tokens 4096.');
-    return { id, name, changed: false, path: file, message: `verified ${codexIds.length} Codex/OpenAI and ${claudeIds.length} Claude models` };
+    return { id, name, changed: false, path: file, message: `verified ${codexIds.length} Codex/OpenAI, ${deepSeekIds.length} DeepSeek, and ${claudeIds.length} Claude models` };
 }
 export async function remove(ctx) {
     const file = clientConfigPath(id, ctx.home, ctx.platform);
@@ -160,7 +191,7 @@ export async function remove(ctx) {
     const doc = parseYaml(text);
     const data = asRecord(doc.toJS());
     const providers = Array.isArray(data.custom_providers) ? data.custom_providers : [];
-    const managedNames = new Set([legacyProviderName, codexProviderName, claudeProviderName]);
+    const managedNames = new Set([legacyProviderName, codexProviderName, deepSeekProviderName, claudeProviderName]);
     const managedProviders = providers.filter((provider) => managedNames.has(provider?.name)
         && (provider?.base_url === openAiBaseUrl(ctx.baseUrl) || provider?.base_url === anthropicOrigin(ctx.baseUrl)));
     if (!managedProviders.length)

package/dist/configure/models.d.ts

@@ -1,6 +1,8 @@
 import { ConfigureContext } from '../types/client.js';
 export declare const DEEPSEEK_V4_FLASH_MODEL_ID = "deepseek-v4-flash";
 export declare function isDeepSeekChatModelId(id: string): boolean;
+/** Trust only the authenticated gateway catalog for endpoint capabilities. */
+export declare function modelSupportsTools(ctx: ConfigureContext, id: string): boolean;
 export declare function modelIds(ctx: ConfigureContext): string[];
 export declare function anthropicModelIds(ctx: ConfigureContext): string[];
 export declare function openAiModelIds(ctx: ConfigureContext): string[];

package/dist/configure/models.js

@@ -1,5 +1,6 @@
 import { isAnthropicModel, isRetiredModelId } from '../utils/api.js';
 const preferredAnthropic = [
+    'claude-opus-5',
     'claude-opus-4-8',
     'claude-sonnet-5',
     'claude-opus-4-7',
@@ -21,6 +22,10 @@ export const DEEPSEEK_V4_FLASH_MODEL_ID = 'deepseek-v4-flash';
 export function isDeepSeekChatModelId(id) {
     return id.trim().toLowerCase() === DEEPSEEK_V4_FLASH_MODEL_ID;
 }
+/** Trust only the authenticated gateway catalog for endpoint capabilities. */
+export function modelSupportsTools(ctx, id) {
+    return (ctx.models || []).find(model => model.id.trim() === id.trim())?.capabilities?.tools === true;
+}
 export function modelIds(ctx) {
     return [...new Set((ctx.models || []).map(model => model.id.trim()).filter(id => id && !isRetiredModelId(id)))];
 }

package/dist/configure/openclaw.js

@@ -3,7 +3,7 @@ import fs from 'fs-extra';
 import { atomicWrite, backupFile } from '../utils/fs.js';
 import { clientConfigPath } from './paths.js';
 import { isScaleMaxManagedText, writeMergedJsonConfig } from './common.js';
-import { anthropicModelIds, anthropicOrigin, deepSeekChatModelIds, fastModel, fastOpenAiModel, modelName, openAiBaseUrl, openAiResponsesModelIds, preferredAnthropicModel, preferredOpenAiResponsesModel } from './models.js';
+import { anthropicModelIds, anthropicOrigin, deepSeekChatModelIds, fastModel, fastOpenAiModel, modelName, modelSupportsTools, openAiBaseUrl, openAiResponsesModelIds, preferredAnthropicModel, preferredOpenAiResponsesModel } from './models.js';
 import { removeClientSecret, rollbackClientSecret, verifyClientSecret, writeClientSecret } from './client-secret.js';
 const id = 'openclaw';
 const name = 'OpenClaw';
@@ -39,11 +39,23 @@ function entries(ctx, ids, family) {
             id: modelId,
             name: modelName(ctx, modelId),
             input: family === 'anthropic' ? ['text', 'image'] : ['text'],
-            maxTokens: Math.min(metadata?.max_output_tokens || 4096, 4096)
+            maxTokens: modelId === 'claude-opus-5'
+                ? Math.min(metadata?.max_output_tokens || 128000, 128000)
+                : Math.min(metadata?.max_output_tokens || 4096, 4096)
         };
         if (family === 'deepseek') {
-            result.reasoning = false;
-            result.compat = { supportsTools: false };
+            const supportsTools = modelSupportsTools(ctx, modelId);
+            result.reasoning = supportsTools;
+            result.compat = supportsTools
+                ? {
+                    supportsTools: true,
+                    supportsToolChoice: false,
+                    supportsReasoningEffort: true,
+                    supportsUsageInStreaming: true,
+                    maxTokensField: 'max_tokens',
+                    requiresReasoningContentOnAssistantMessages: true,
+                }
+                : { supportsTools: false };
         }
         if (metadata?.context_window || family === 'anthropic')
             result.contextWindow = metadata?.context_window || 200000;
@@ -242,7 +254,11 @@ export async function verify(ctx) {
     };
     const deepSeekModels = Array.isArray(deepSeek?.models) ? deepSeek.models : [];
     const deepSeekValid = valid(deepSeek, openAiBaseUrl(ctx.baseUrl), 'openai-completions', deepSeekIds)
-        && deepSeekModels.every((model) => model?.compat?.supportsTools === false);
+        && deepSeekModels.every((model) => {
+            const expected = modelSupportsTools(ctx, String(model?.id || ''));
+            return model?.compat?.supportsTools === expected
+                && (!expected || model?.compat?.requiresReasoningContentOnAssistantMessages === true);
+        });
     if ((codexIds.length ? !valid(codex, openAiBaseUrl(ctx.baseUrl), 'openai-responses', codexIds) : Boolean(codex))
         || (deepSeekIds.length ? !deepSeekValid : Boolean(deepSeek))
         || (claudeIds.length ? !valid(claude, anthropicOrigin(ctx.baseUrl), 'anthropic-messages', claudeIds) : Boolean(claude))

package/dist/configure/opencode.js

@@ -19,7 +19,9 @@ function providerConfig(ctx) {
                 name: modelName(ctx, modelId),
                 limit: {
                     context: metadata?.context_window || (modelId.startsWith('claude-') ? 200000 : 128000),
-                    output: Math.min(metadata?.max_output_tokens || 4096, 4096)
+                    output: modelId === 'claude-opus-5'
+                        ? Math.min(metadata?.max_output_tokens || 128000, 128000)
+                        : Math.min(metadata?.max_output_tokens || 4096, 4096)
                 }
             }];
     }));

package/dist/configure/roo-code.js

@@ -3,7 +3,7 @@ import fs from 'fs-extra';
 import JSON5 from 'json5';
 import { atomicWrite, backupFile } from '../utils/fs.js';
 import { clientConfigPath } from './paths.js';
-import { anthropicModelIds, isDeepSeekChatModelId, openAiBaseUrl, openAiResponsesModelIds, preferredAnthropicModel, preferredChatCompletionsModel, preferredOpenAiResponsesModel } from './models.js';
+import { anthropicModelIds, deepSeekChatModelIds, isDeepSeekChatModelId, modelSupportsTools, openAiBaseUrl, openAiResponsesModelIds, preferredAnthropicModel, preferredChatCompletionsModel, preferredOpenAiResponsesModel } from './models.js';
 import { isAnthropicModel } from '../utils/api.js';
 const id = 'roo-code';
 const name = 'Roo Code (VS Code)';
@@ -19,8 +19,10 @@ function importPath(home) { return path.join(home, '.scalemax', 'roo-code-import
 function fallbackProfileFor(ctx) {
     const model = preferredChatCompletionsModel(ctx);
     const metadata = (ctx.models || []).find(candidate => candidate.id === model) || { id: model };
+    if (isDeepSeekChatModelId(model) && !modelSupportsTools(ctx, model))
+        throw new Error('Roo Code requires task-completion tool calling, but the active DeepSeek V4 Flash route is text-only. Use Continue Chat/Edit in VS Code or configure the official tool-capable route. No configuration was changed.');
     if (isDeepSeekChatModelId(model))
-        throw new Error('Roo Code requires task-completion tool calling, which DeepSeek V4 Flash does not expose. Use Continue Chat/Edit in VS Code instead. No configuration was changed.');
+        return { name: deepSeekProfileName, id: deepSeekProfileId, model };
     return isAnthropicModel(metadata)
         ? { name: claudeProfileName, id: claudeProfileId, model }
         : { name: codexProfileName, id: codexProfileId, model };
@@ -35,6 +37,11 @@ function profilesFor(ctx) {
     if (scope !== 'openai' && anthropicModelIds(ctx).length) {
         profiles.push({ name: claudeProfileName, id: claudeProfileId, model: preferredAnthropicModel(ctx) });
     }
+    for (const model of deepSeekChatModelIds(ctx)) {
+        if (modelSupportsTools(ctx, model)) {
+            profiles.push({ name: deepSeekProfileName, id: deepSeekProfileId, model });
+        }
+    }
     return profiles.length ? profiles : [fallbackProfileFor(ctx)];
 }
 function currentProfileFor(ctx, profiles = profilesFor(ctx)) {
@@ -42,6 +49,8 @@ function currentProfileFor(ctx, profiles = profilesFor(ctx)) {
         return profiles.find(profile => profile.id === claudeProfileId) || profiles[0];
     if (ctx.providerScope === 'openai')
         return profiles.find(profile => profile.id === codexProfileId) || profiles[0];
+    if (ctx.providerScope === 'deepseek-v4-flash')
+        return profiles.find(profile => profile.id === deepSeekProfileId) || profiles[0];
     return profiles.find(profile => profile.id === codexProfileId) || profiles[0];
 }
 function parseSettings(text, file) {

package/dist/types/client.d.ts

@@ -43,6 +43,10 @@ export interface ConfigureContext extends DetectContext {
         display_name?: string;
         context_window?: number | null;
         max_output_tokens?: number | null;
+        capabilities?: {
+            tools?: boolean;
+            [key: string]: unknown;
+        };
     }>;
 }
 export interface ConfigureResult {

package/dist/utils/api.d.ts

@@ -8,6 +8,10 @@ export interface ModelInfo {
     display_name?: string;
     context_window?: number | null;
     max_output_tokens?: number | null;
+    capabilities?: {
+        tools?: boolean;
+        [key: string]: unknown;
+    };
 }
 export interface KeyMetadata {
     provider_scope: ProviderScope;
@@ -22,6 +26,7 @@ export interface ApiValidation {
     baseUrl?: string;
     error?: string;
     surfaceMismatch?: boolean;
+    transportFailure?: boolean;
 }
 export type ChatRole = 'system' | 'user' | 'assistant';
 export interface ChatMessage {

package/dist/utils/api.js

@@ -59,6 +59,16 @@ async function friendlyError(res) {
 function retryableStatus(status) {
     return status === 408 || status === 429 || status >= 500;
 }
+function safeTransportError(error, timeoutSeconds) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (/abort|timeout|timed?\s*out/i.test(message)) {
+        return `ScaleMax request timed out after ${timeoutSeconds} seconds. Please try again.`;
+    }
+    // Native fetch intentionally hides DNS/TLS/proxy details behind the generic
+    // "fetch failed" message. It is not an authentication verdict and may
+    // contain environment-specific detail that is not useful in an installer.
+    return 'Could not reach the ScaleMax API. Check your network, proxy/VPN, firewall, and TLS settings, then retry.';
+}
 async function request(path, apiKey, init = {}, retryGet = false, baseUrl = SCALEMAX_BASE_URL, timeoutMs = 15000) {
     const headers = new Headers(init.headers);
     if (apiKey)
@@ -119,37 +129,43 @@ export async function createChatCompletion(options) {
         return { ok: true, content: redactApiKey(content, apiKey) };
     }
     catch (err) {
-        const message = redactApiKey(err instanceof Error ? err.message : String(err), apiKey);
-        return { ok: false, error: /abort|timeout/i.test(message) ? 'The ScaleMax helper request timed out after 45 seconds.' : message };
+        return { ok: false, error: safeTransportError(err, 45) };
     }
 }
 async function validateOnSurface(apiKey, baseUrl) {
+    let authCheck;
     try {
-        const [authCheck, modelsRes] = await Promise.all([
-            request('/usage', apiKey, {}, true, baseUrl),
-            request('/models', apiKey, {}, true, baseUrl)
-        ]);
-        if (!authCheck.ok)
-            return { ok: false, models: [], error: redactApiKey(await friendlyError(authCheck), apiKey), surfaceMismatch: authCheck.status === 401 };
-        const usage = await authCheck.json().catch(() => ({}));
-        const rawScope = usage?.key?.provider_scope ?? 'both';
-        const parsedScope = providerScope(rawScope);
-        if (!parsedScope)
-            return { ok: false, models: [], error: 'ScaleMax returned an unsupported API-key model scope.' };
-        const keyMeta = { provider_scope: parsedScope, mode: usage?.key?.mode, prefix: usage?.key?.prefix, label: usage?.key?.label };
-        if (!modelsRes.ok)
-            return { ok: false, models: [], key: keyMeta, error: redactApiKey(await friendlyError(modelsRes), apiKey) };
-        const data = await modelsRes.json();
-        const catalog = Array.isArray(data.data) ? data.data : [];
-        const models = filterModelsForScope(catalog, keyMeta.provider_scope);
-        if (!models.length)
-            return { ok: false, models: [], key: keyMeta, error: 'ScaleMax returned an empty model catalog.' };
-        return { ok: true, models, key: keyMeta, baseUrl };
+        // Authenticate first. The previous concurrent /usage + /models probes
+        // allowed a transient model-catalog network failure to hide a valid token
+        // key's 401 surface hint, so the CLI never tried its correct token URL.
+        authCheck = await request('/usage', apiKey, {}, true, baseUrl);
     }
     catch (err) {
-        const message = redactApiKey(err instanceof Error ? err.message : String(err), apiKey);
-        return { ok: false, models: [], error: /abort|timeout/i.test(message) ? 'ScaleMax request timed out after 15 seconds.' : message };
+        return { ok: false, models: [], error: safeTransportError(err, 30), transportFailure: true };
+    }
+    if (!authCheck.ok)
+        return { ok: false, models: [], error: redactApiKey(await friendlyError(authCheck), apiKey), surfaceMismatch: authCheck.status === 401 };
+    const usage = await authCheck.json().catch(() => ({}));
+    const rawScope = usage?.key?.provider_scope ?? 'both';
+    const parsedScope = providerScope(rawScope);
+    if (!parsedScope)
+        return { ok: false, models: [], error: 'ScaleMax returned an unsupported API-key model scope.' };
+    const keyMeta = { provider_scope: parsedScope, mode: usage?.key?.mode, prefix: usage?.key?.prefix, label: usage?.key?.label };
+    let modelsRes;
+    try {
+        modelsRes = await request('/models', apiKey, {}, true, baseUrl);
     }
+    catch (err) {
+        return { ok: false, models: [], key: keyMeta, error: safeTransportError(err, 30), transportFailure: true };
+    }
+    if (!modelsRes.ok)
+        return { ok: false, models: [], key: keyMeta, error: redactApiKey(await friendlyError(modelsRes), apiKey), surfaceMismatch: modelsRes.status === 401 };
+    const data = await modelsRes.json();
+    const catalog = Array.isArray(data.data) ? data.data : [];
+    const models = filterModelsForScope(catalog, keyMeta.provider_scope);
+    if (!models.length)
+        return { ok: false, models: [], key: keyMeta, error: 'ScaleMax returned an empty model catalog.' };
+    return { ok: true, models, key: keyMeta, baseUrl };
 }
 export async function validateApiKey(apiKey) {
     const credit = await validateOnSurface(apiKey, SCALEMAX_BASE_URL);
@@ -160,7 +176,12 @@ export async function validateApiKey(apiKey) {
     const token = await validateOnSurface(apiKey, SCALEMAX_TOKEN_BASE_URL);
     if (token.ok)
         return token;
-    return credit.error && !/Invalid API key|rejected|401/i.test(credit.error) ? credit : token;
+    // A credit-surface 401 can be a valid token key. Prefer a token transport
+    // diagnosis over incorrectly calling it invalid; when both surfaces give
+    // confirmed auth failures, retain the clear original credit error.
+    if (token.transportFailure)
+        return token;
+    return token.surfaceMismatch ? credit : token;
 }
 export async function testStreaming(apiKey, model, baseUrl = SCALEMAX_BASE_URL) {
     const selected = model || 'fable-5';
@@ -175,6 +196,6 @@ export async function testStreaming(apiKey, model, baseUrl = SCALEMAX_BASE_URL)
         return { ok: true };
     }
     catch (err) {
-        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+        return { ok: false, error: safeTransportError(err, 15) };
     }
 }

package/dist/utils/installerConfig.js

@@ -22,8 +22,8 @@ export async function promptForValidatedKey(home, message = 'Enter your ScaleMax
     const spinner = ora('Validating API key').start();
     const result = await validateApiKey(candidate);
     if (!result.ok) {
-        spinner.fail('Invalid API key');
-        throw new Error(result.error || 'Invalid API key');
+        spinner.fail('Could not verify API key');
+        throw new Error(result.error || 'Could not verify API key');
     }
     await saveApiKey(candidate, result.baseUrl, home);
     spinner.succeed('API key verified and saved');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scalemax",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "description": "Universal ScaleMax installer for AI coding clients",
   "type": "module",
   "bin": {