scalemax 0.1.31 → 0.1.33

package/README.md

@@ -136,6 +136,7 @@ The helper refuses unrelated requests and redacts ScaleMax-style secrets from pr
 - Codex
 - Cursor
 - Roo Code (VS Code)
+- Cline (CLI and VS Code)
 - Continue (VS Code)
 - TRAE SOLO
 - Claude Code
@@ -161,7 +162,7 @@ ScaleMax merges a named `scalemax` provider into `~/.config/opencode/opencode.js
 
 ### OpenClaw
 
-ScaleMax partitions OpenClaw models into native `openai-responses` (`scalemax-codex`, `/v1`), OpenAI-compatible `openai-completions` (`scalemax-deepseek`, `/v1`), and `anthropic-messages` (`scalemax-claude`, origin) providers. `deepseek-v4-flash` is always isolated in the Chat Completions provider and never advertised through Responses. Its agent flags come from authenticated catalog discovery: the official route enables tools, reasoning effort, streaming usage, and mandatory `reasoning_content` replay while disabling unsupported thinking-mode `tool_choice`; a fallback route remains explicitly tool-free. The API key and compatibility User-Agent are OpenClaw file-backed SecretRefs stored in private `0600` files under `~/.openclaw/secrets/`; neither value is embedded in the main provider JSON. Migration removes the obsolete mixed provider, preserves the active model family, and scrubs plaintext credentials from generated ScaleMax agent registries even when they contain an older key. Output is capped at 4096 tokens, private-network routing is denied for the public gateway, and unrelated providers and agent settings are preserved.
+ScaleMax partitions OpenClaw models into native `openai-responses` (`scalemax-codex`, `/v1`), OpenAI-compatible `openai-completions` (`scalemax-deepseek`, `/v1`), and `anthropic-messages` (`scalemax-claude`, origin) providers. `deepseek-v4-flash` is always isolated in the Chat Completions provider and never advertised through Responses. Its agent flags come only from authenticated catalog discovery: tools, forced `tool_choice`, reasoning, reasoning effort, streamed usage, and `reasoning_content` replay are each enabled only when the exact model advertises that capability. In particular, a tool-capable route is never forced to replay reasoning content unless `capabilities.reasoning_replay=true`; a fallback route remains explicitly tool-free. The API key and compatibility User-Agent are OpenClaw file-backed SecretRefs stored in private `0600` files under `~/.openclaw/secrets/`; neither value is embedded in the main provider JSON. Migration removes the obsolete mixed provider, preserves the active model family, and scrubs plaintext credentials from generated ScaleMax agent registries even when they contain an older key. Output is capped at 4096 tokens, private-network routing is denied for the public gateway, and unrelated providers and agent settings are preserved.
 
 ### Hermes
 
@@ -171,6 +172,10 @@ ScaleMax creates family-specific Hermes providers in `~/.hermes/config.yaml` and
 
 Roo Code stores provider profiles and secrets in VS Code extension storage, so ScaleMax does not mutate its private database. Instead, the CLI writes a private `0600` Roo settings-import file at `~/.scalemax/roo-code-import.json` and points the supported `roo-cline.autoImportSettingsPath` VS Code setting at it. Codex, Claude, and tool-capable DeepSeek profiles remain separate. DeepSeek is offered only when authenticated discovery reports `capabilities.tools=true`; otherwise Roo fails closed and points the user to Continue Chat/Edit. Reload VS Code once so Roo imports supported profiles into its SecretStorage. CLI verification intentionally reports the handoff as verified, not the extension runtime, until that reload occurs.
 
+### Cline (CLI and VS Code)
+
+ScaleMax supports the verified Cline CLI `3.0.47` and VS Code extension `4.0.12` formats. The CLI surface uses Cline's built-in `openai-native` provider and Responses protocol. The extension uses its built-in OpenAI-compatible provider. Both receive the raw ScaleMax key and the matching credit or token base URL; ScaleMax never writes a custom `Authorization` or `x-api-key` header because Cline generates `Authorization: Bearer …` itself. Configuration is attempted only while Cline and VS Code are stopped, preserves unrelated state, uses private atomic files with backups and rollback, and fails closed on unknown versions or malformed/symlinked state.
+
 ### Continue (VS Code)
 
 Continue is the universal VS Code Chat/Edit route for `deepseek-v4-flash`. The CLI installs the official `Continue.continue` extension when VS Code is available, merges an OpenAI-compatible model into `~/.continue/config.yaml`, sets `useResponsesApi: false`, and keeps the authenticated ScaleMax key in private `~/.continue/.env` rather than the YAML. Existing Continue models and environment entries are preserved. Reload VS Code and select **ScaleMax DeepSeek V4 Flash**. For agent workflows, prefer Roo/OpenClaw/Hermes when the authenticated catalog reports `capabilities.tools=true`.

package/dist/clients.js

@@ -4,6 +4,8 @@ import * as cursorDetect from './detect/cursor.js';
 import * as cursorConfig from './configure/cursor.js';
 import * as rooCodeDetect from './detect/roo-code.js';
 import * as rooCodeConfig from './configure/roo-code.js';
+import * as clineDetect from './detect/cline.js';
+import * as clineConfig from './configure/cline.js';
 import * as continueDetect from './detect/continue.js';
 import * as continueConfig from './configure/continue.js';
 import * as traeSoloDetect from './detect/trae-solo.js';
@@ -24,6 +26,7 @@ export const clients = [
     { id: 'codex', name: 'Codex', detect: codexDetect.detect, install: codexConfig.install, configure: codexConfig.configure, verify: codexConfig.verify, launch: codexConfig.launch, remove: codexConfig.remove },
     { id: 'cursor', name: 'Cursor', detect: cursorDetect.detect, configure: cursorConfig.configure, verify: cursorConfig.verify, remove: cursorConfig.remove },
     { id: 'roo-code', name: 'Roo Code (VS Code)', detect: rooCodeDetect.detect, configure: rooCodeConfig.configure, verify: rooCodeConfig.verify, remove: rooCodeConfig.remove },
+    { id: 'cline', name: 'Cline', detect: clineDetect.detect, install: clineConfig.install, configure: clineConfig.configure, verify: clineConfig.verify, remove: clineConfig.remove },
     { id: 'continue', name: 'Continue (VS Code)', detect: continueDetect.detect, install: continueConfig.install, configure: continueConfig.configure, verify: continueConfig.verify, remove: continueConfig.remove },
     { id: 'trae-solo', name: 'TRAE SOLO', detect: traeSoloDetect.detect, configure: traeSoloConfig.configure, remove: traeSoloConfig.remove },
     { id: 'claude', name: 'Claude Code', detect: claudeDetect.detect, configure: claudeConfig.configure, verify: claudeConfig.verify, remove: claudeConfig.remove },

package/dist/commands/configure.js

@@ -4,9 +4,9 @@ import ora from 'ora';
 import { clients } from '../clients.js';
 import { SCALEMAX_BASE_URL } from '../constants.js';
 import { loadApiKey } from '../utils/keyStore.js';
-import { validateApiKey, isAnthropicModel } from '../utils/api.js';
+import { validateApiKey, isAnthropicModel, isModelRouteAvailable } from '../utils/api.js';
 import { homeDir } from '../utils/paths.js';
-import { isDeepSeekChatModelId } from '../configure/models.js';
+import { isExactChatCompletionsModelId } from '../configure/models.js';
 export async function detectAll(home = homeDir()) {
     const ctx = { home, platform: process.platform, env: process.env };
     return Promise.all(clients.map(c => c.detect(ctx)));
@@ -41,23 +41,27 @@ async function maybeLaunchCodex(chosen, successful, baseUrl = SCALEMAX_BASE_URL)
     console.log('\nIf Codex asks for authentication,\nit should already be configured to use ScaleMax.\n\nIf you still see the official login screen,\nthe configuration is incomplete or Codex rejected the generated auth/config files.\n');
 }
 export function clientAllowedForModels(clientId, models) {
+    models = models.filter(isModelRouteAvailable);
     if (!models.length)
         return false;
     // These clients use either a native family-specific adapter or the gateway's
     // normalized OpenAI-compatible Chat Completions route, which supports both
     // authenticated model families. Codex remains Responses-only; TRAE uses
     // OpenAI-compatible Chat Completions.
-    const crossProtocolClients = new Set(['cursor', 'roo-code', 'opencode', 'openclaw', 'hermes', 'cherry-studio', 'api-code']);
+    const crossProtocolClients = new Set(['cursor', 'roo-code', 'cline', 'opencode', 'openclaw', 'hermes', 'cherry-studio', 'api-code']);
     if (clientId === 'continue')
-        return models.some(model => isDeepSeekChatModelId(model.id));
+        return models.some(model => isExactChatCompletionsModelId(model.id));
     if (clientId === 'claude')
         return models.some(isAnthropicModel);
     if (clientId === 'codex')
-        return models.some(model => !isAnthropicModel(model) && !isDeepSeekChatModelId(model.id));
-    if (clientId === 'hermes' && models.every(model => isDeepSeekChatModelId(model.id)))
-        return false;
-    if (clientId === 'roo-code' && models.every(model => isDeepSeekChatModelId(model.id)))
-        return false;
+        return models.some(model => !isAnthropicModel(model) && !isExactChatCompletionsModelId(model.id));
+    if (clientId === 'hermes' && models.every(model => isExactChatCompletionsModelId(model.id)))
+        return models.some(model => model.capabilities?.tools === true);
+    // Roo is an agent, not a text-only chat surface. Its task loop depends on
+    // native function calls for every model family, so offer it only when the
+    // authenticated catalog confirms at least one viable route.
+    if (clientId === 'roo-code' || clientId === 'cline')
+        return models.some(model => model.capabilities?.tools === true);
     if (crossProtocolClients.has(clientId))
         return true;
     return models.some(model => !isAnthropicModel(model));
@@ -65,6 +69,8 @@ export function clientAllowedForModels(clientId, models) {
 function scopeHint(scope) {
     if (scope === 'deepseek-v4-flash')
         return 'DeepSeek V4 Flash only';
+    if (scope === 'glm-5.2')
+        return 'GLM 5.2 only';
     return scope === 'both' ? 'OpenAI + Claude' : scope === 'anthropic' ? 'Claude only' : 'OpenAI only';
 }
 export async function configureCommand(opts = {}) {

package/dist/commands/helper-bot.js

@@ -4,13 +4,14 @@ import { createInterface } from 'node:readline/promises';
 import { execa } from 'execa';
 import { clients } from '../clients.js';
 import { helperDocsContext } from './helper-docs.js';
-import { createChatCompletion, isAnthropicModel } from '../utils/api.js';
+import { createChatCompletion, filterModelsForScope, isAnthropicModel } from '../utils/api.js';
 import { redactApiKey } from '../utils/apiKey.js';
 import { loadApiKey } from '../utils/keyStore.js';
 import { homeDir } from '../utils/paths.js';
 import { validateApiKey } from '../utils/api.js';
 import { commandExists } from '../utils/exec.js';
 import { installClaudeGithubTools } from '../configure/claude-tools.js';
+import { isExactChatCompletionsModelId } from '../configure/models.js';
 export const SCALEMAX_HELPER_REFUSAL = `I am the official ScaleMax Helper.
 
 I can only assist with installing, configuring, repairing, verifying, and troubleshooting ScaleMax.
@@ -762,6 +763,7 @@ For automatic configuration, exit with \`/quit\`, run \`scalemax update\`, then
 const HELPER_CLIENT_PATTERNS = [
     { id: 'continue', pattern: /\b(?:continue(?:\.dev)?|vscode\s+continue|vs\s+code\s+continue)\b/i },
     { id: 'roo-code', pattern: /\b(?:roo(?:\s+code)?|roo\s+(?:extension|plugin)|vscode\s+roo|vs\s+code\s+roo)\b/i },
+    { id: 'cline', pattern: /\bcline(?:\s+(?:extension|plugin|cli))?\b/i },
     { id: 'openclaw', pattern: /\bopen\s*claw\b/i },
     { id: 'opencode', pattern: /\bopen\s*code\b/i },
     { id: 'cherry-studio', pattern: /\bcherry\s*studio\b/i },
@@ -800,6 +802,8 @@ function helperActionTarget(question) {
     return undefined;
 }
 function requestedProviderScope(question, target) {
+    if (/\bglm[-\s]*5[._\s]*2\b/i.test(question))
+        return 'glm-5.2';
     if (/\bdeepseek(?:[-\s]+v4[-\s]+flash)?\b/i.test(question))
         return 'deepseek-v4-flash';
     if (/\b(?:both|openai\s*\+\s*claude|claude\s*\+\s*openai)\b/i.test(question))
@@ -811,35 +815,48 @@ function requestedProviderScope(question, target) {
     return undefined;
 }
 function actionModels(connection, requestedScope) {
-    const catalog = connection.modelCatalog?.length
+    const rawCatalog = connection.modelCatalog?.length
         ? connection.modelCatalog
         : (connection.availableModels || []).map(id => ({ id }));
+    const entitlement = connection.providerScope || 'both';
+    // Always begin with the key's verified entitlement. Natural-language intent
+    // must never widen an exact-model key into an OpenAI/Claude family key.
+    const catalog = filterModelsForScope(rawCatalog, entitlement);
     if (!requestedScope)
         return catalog;
-    if (requestedScope === 'deepseek-v4-flash') {
-        return catalog.filter(model => model.id.trim().toLowerCase() === 'deepseek-v4-flash');
+    const exactEntitlement = entitlement === 'deepseek-v4-flash' || entitlement === 'glm-5.2';
+    if (exactEntitlement && requestedScope !== entitlement)
+        return [];
+    if (requestedScope === 'deepseek-v4-flash' || requestedScope === 'glm-5.2') {
+        return requestedScope === entitlement
+            ? catalog.filter(model => model.id.trim().toLowerCase() === requestedScope)
+            : [];
     }
     if (requestedScope === 'both') {
-        return catalog.filter(model => model.id.trim().toLowerCase() !== 'deepseek-v4-flash');
+        return catalog.filter(model => !isExactChatCompletionsModelId(model.id));
     }
     return catalog.filter(model => requestedScope === 'anthropic'
         ? isAnthropicModel(model)
-        : !isAnthropicModel(model) && model.id.trim().toLowerCase() !== 'deepseek-v4-flash');
+        : !isAnthropicModel(model) && !isExactChatCompletionsModelId(model.id));
 }
 function helperClientAllowedForModels(clientId, models) {
     if (!models.length)
         return false;
-    const crossProtocolClients = new Set(['cursor', 'roo-code', 'opencode', 'openclaw', 'hermes', 'cherry-studio', 'api-code']);
-    const onlyDeepSeek = models.every(model => model.id.trim().toLowerCase() === 'deepseek-v4-flash');
+    const crossProtocolClients = new Set(['cursor', 'roo-code', 'cline', 'opencode', 'openclaw', 'hermes', 'cherry-studio', 'api-code']);
+    const onlyExactChat = models.every(model => isExactChatCompletionsModelId(model.id));
     if (clientId === 'continue')
-        return onlyDeepSeek;
+        return onlyExactChat;
     if (clientId === 'claude')
         return models.some(isAnthropicModel);
-    if ((clientId === 'codex' || clientId === 'hermes' || clientId === 'roo-code') && onlyDeepSeek)
+    if (clientId === 'codex' && onlyExactChat)
         return false;
+    if (clientId === 'hermes' && onlyExactChat)
+        return models.some(model => model.capabilities?.tools === true);
+    if (clientId === 'roo-code' || clientId === 'cline')
+        return models.some(model => model.capabilities?.tools === true);
     if (crossProtocolClients.has(clientId))
         return true;
-    return models.some(model => !isAnthropicModel(model) && model.id.trim().toLowerCase() !== 'deepseek-v4-flash');
+    return models.some(model => !isAnthropicModel(model) && !isExactChatCompletionsModelId(model.id));
 }
 function hasRooCodeExtension(paths) {
     return paths.some(candidate => /^rooveterinaryinc\.roo-cline-/i.test(path.basename(candidate)));
@@ -923,8 +940,8 @@ async function installRooCodeExtension(ctx, client, write) {
 async function runOneHelperClientAction(kind, client, connection, home, requestedScope, write) {
     const models = actionModels(connection, requestedScope);
     if (!models.length)
-        throw new Error(`The authenticated key does not expose ${requestedScope === 'anthropic' ? 'Claude' : requestedScope === 'openai' ? 'OpenAI' : requestedScope === 'deepseek-v4-flash' ? 'DeepSeek V4 Flash' : 'compatible'} models for ${client.name}. No configuration was changed.`);
-    if (client.id === 'codex' && models.every(model => isAnthropicModel(model) || model.id.trim().toLowerCase() === 'deepseek-v4-flash'))
+        throw new Error(`The authenticated key does not expose ${requestedScope === 'anthropic' ? 'Claude' : requestedScope === 'openai' ? 'OpenAI' : requestedScope === 'deepseek-v4-flash' ? 'DeepSeek V4 Flash' : requestedScope === 'glm-5.2' ? 'GLM 5.2' : 'compatible'} models for ${client.name}. No configuration was changed.`);
+    if (client.id === 'codex' && models.every(model => isAnthropicModel(model) || isExactChatCompletionsModelId(model.id)))
         throw new Error('Codex requires a Responses-capable model, but this key exposes only Claude or Chat-Completions-only models. No configuration was changed.');
     if (client.id === 'cursor' && connection.platform !== 'darwin')
         throw new Error(`Automatic Cursor configuration is currently verified on macOS only. ${helperPlatformName(connection.platform)} was not modified.`);
@@ -934,7 +951,7 @@ async function runOneHelperClientAction(kind, client, connection, home, requeste
         env: { ...process.env },
         apiKey: connection.apiKey,
         baseUrl: connection.baseUrl,
-        providerScope: requestedScope || connection.providerScope || 'both',
+        providerScope: connection.providerScope || 'both',
         models,
         interactive: false,
         allowAppModification: false
@@ -998,7 +1015,9 @@ async function runOneHelperClientAction(kind, client, connection, home, requeste
     }
     const activation = client.id === 'roo-code'
         ? ' Reload VS Code once so Roo Code imports the verified ScaleMax profile.'
-        : client.id === 'continue' ? ' Reload VS Code once so Continue loads the verified ScaleMax profile.' : '';
+        : client.id === 'cline'
+            ? ' Restart Cline; reload VS Code too when using the extension.'
+            : client.id === 'continue' ? ' Reload VS Code once so Continue loads the verified ScaleMax profile.' : '';
     return `✅ Successfully completed: ${client.name} is configured and locally verified.${activation}`;
 }
 /** Execute only narrowly allowlisted ScaleMax client actions; never model-generated shell commands. */

package/dist/configure/cline.d.ts

@@ -0,0 +1,29 @@
+import { ConfigureContext, ConfigureResult, DetectContext, InstallContext } from '../types/client.js';
+export interface ClineExtensionSurface {
+    path: string;
+    version?: string;
+    supported: boolean;
+}
+export interface ClineSurfaces {
+    cliInstalled: boolean;
+    cliVersion?: string;
+    cliSupported: boolean;
+    extensions: ClineExtensionSurface[];
+    extensionInstalled: boolean;
+    extensionSupported: boolean;
+}
+export declare function clineExtensionStatePaths(ctx: Pick<DetectContext, 'home' | 'env'>): {
+    globalStateFile: string;
+    secretsFile: string;
+};
+export declare function inspectClineSurfaces(ctx: DetectContext): Promise<ClineSurfaces>;
+export declare function clineProcessConflicts(output: string, platform: NodeJS.Platform): {
+    cli: boolean;
+    extension: boolean;
+};
+export declare function install(ctx: InstallContext): Promise<ConfigureResult>;
+export declare function configure(ctx: ConfigureContext): Promise<ConfigureResult>;
+export declare function verify(ctx: ConfigureContext): Promise<ConfigureResult>;
+export declare function isManagedCliStore(value: unknown): boolean;
+export declare function isManagedExtensionState(globalState: unknown, secrets: unknown): boolean;
+export declare function remove(ctx: ConfigureContext): Promise<ConfigureResult>;