scalemax 0.1.34 → 0.1.36

package/README.md

@@ -205,7 +205,7 @@ npx scalemax models
 ```
 
 The model list is fetched live from `https://api.scalemax.pro/v1/models` every time, so disabled or unsupported models disappear immediately without manual cache cleanup.
-Key metadata and the authenticated model catalog are fetched concurrently on the normal path. Safe GET checks receive one short, jittered retry on transient network, rate-limit, or server failures; model-generation POST requests are never retried by the installer.
+The CLI authenticates the key before loading its model catalog. Safe GET checks receive one short, jittered retry on transient network, rate-limit, or server failures; model-generation POST requests are never retried by the installer. CLI requests honor `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` and automatically try the usable IPv4 or IPv6 route.
 
 Run diagnostics:
 
@@ -289,6 +289,20 @@ Or clear the npm cache:
 npm cache verify
 ```
 
+### `Could not reach the ScaleMax API`
+
+Use the latest CLI first:
+
+```bash
+npx scalemax@latest
+```
+
+ScaleMax automatically honors `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`
+when a workplace or ISP requires an outbound proxy. It also falls back between
+IPv4 and IPv6. If the error specifically reports DNS or TLS, correct the
+device DNS/system clock or disable HTTPS inspection for `api.scalemax.pro`,
+then rerun the command. Never disable TLS verification.
+
 ### Client config looks wrong
 
 Run:

package/dist/configure/models.js

@@ -16,6 +16,23 @@ const preferredOpenAi = [
     'gpt-5.4-mini',
     'gpt-5.3-codex',
     'codex-auto-review',
+    // Gemini / Grok / Qwen ride the same OpenAI-compatible route, so they are
+    // ranked in the same list. Ordering across families is harmless: a key is
+    // scoped to ONE family, so filterModelsForScope has already reduced the
+    // candidates to that family before this runs. Listing them means each family
+    // picks its own flagship rather than whatever the catalog happened to return
+    // first — preferredFrom's fallback made it work, but arbitrarily.
+    'gemini-3-pro-preview',
+    'gemini-3.1-pro-preview',
+    'gemini-3.6-flash',
+    'gemini-3.5-flash',
+    'gemini-3-flash-preview',
+    'gemini-3.1-flash-lite-preview',
+    'gemini-2.5-flash',
+    'gemini-2.5-flash-lite',
+    'grok-4.5',
+    'qwen3.7-plus',
+    'qwen3.6-plus',
     'glm-5.2',
     'deepseek-v4-flash'
 ];

package/dist/types/client.d.ts

@@ -1,5 +1,5 @@
 export type ClientId = 'codex' | 'cursor' | 'roo-code' | 'cline' | 'continue' | 'trae-solo' | 'claude' | 'opencode' | 'openclaw' | 'hermes' | 'cherry-studio' | 'api-code';
-export type ProviderScope = 'openai' | 'anthropic' | 'both' | 'deepseek-v4-flash' | 'glm-5.2';
+export type ProviderScope = 'openai' | 'anthropic' | 'both' | 'gemini' | 'grok' | 'qwen' | 'deepseek-v4-flash' | 'glm-5.2';
 export interface ClientDefinition {
     id: ClientId;
     name: string;

package/dist/utils/api.d.ts

@@ -1,6 +1,6 @@
 export declare const DEEPSEEK_V4_FLASH_SCOPE: "deepseek-v4-flash";
 export declare const GLM_5_2_SCOPE: "glm-5.2";
-export type ProviderScope = 'openai' | 'anthropic' | 'both' | typeof DEEPSEEK_V4_FLASH_SCOPE | typeof GLM_5_2_SCOPE;
+export type ProviderScope = 'openai' | 'anthropic' | 'both' | 'gemini' | 'grok' | 'qwen' | typeof DEEPSEEK_V4_FLASH_SCOPE | typeof GLM_5_2_SCOPE;
 export interface ModelInfo {
     id: string;
     object?: string;

package/dist/utils/api.js

@@ -1,7 +1,20 @@
 import { SCALEMAX_BASE_URL, SCALEMAX_TOKEN_BASE_URL } from '../constants.js';
 import { redactApiKey, sanitizeApiKey } from './apiKey.js';
+import { scaleMaxFetch } from './network.js';
 export const DEEPSEEK_V4_FLASH_SCOPE = 'deepseek-v4-flash';
 export const GLM_5_2_SCOPE = 'glm-5.2';
+/**
+ * Provider FAMILIES sold as their own scope. Each reaches only its own models;
+ * `both` deliberately does not inherit them, matching the gateway.
+ */
+const FAMILY_SCOPES = ['gemini', 'grok', 'qwen'];
+function isFamilyScope(scope) {
+    return FAMILY_SCOPES.includes(scope);
+}
+/** The family a model belongs to, from the catalog's own owned_by/provider. */
+function modelFamily(model) {
+    return String(model.provider || model.owned_by || '').trim().toLowerCase();
+}
 // Keep only aliases that are no longer offered. Direct GPT-5.6 Sol is an
 // active Codex model and must remain available to all generated clients.
 export const RETIRED_MODEL_IDS = new Set(['fable-5-ultra']);
@@ -40,6 +53,18 @@ export function filterModelsForScope(models, scope) {
             return scope === exactScope;
         if (scope === DEEPSEEK_V4_FLASH_SCOPE || scope === GLM_5_2_SCOPE)
             return false;
+        // A family scope reaches ONLY its own family. This must be an allowlist:
+        // the old final line fell through to `!isAnthropicModel(model)` for any
+        // unrecognised scope, so a gemini key was offered every non-Anthropic model
+        // — GPT, Codex, Grok, Qwen — and `scalemax setup` wrote a client profile
+        // whose every model 403s at the gateway.
+        if (isFamilyScope(scope))
+            return modelFamily(model) === scope;
+        // Conversely, a family model must not leak into the broad scopes: an
+        // openai/both key cannot call them (the gateway prices those families
+        // separately), so offering them here would be the same lie in reverse.
+        if (FAMILY_SCOPES.includes(modelFamily(model)))
+            return false;
         return scope === 'both' || (scope === 'anthropic' ? isAnthropicModel(model) : !isAnthropicModel(model));
     });
 }
@@ -77,9 +102,21 @@ function retryableStatus(status) {
 }
 function safeTransportError(error, timeoutSeconds) {
     const message = error instanceof Error ? error.message : String(error);
+    const cause = error && typeof error === 'object' && 'cause' in error
+        ? error.cause
+        : undefined;
+    const code = cause && typeof cause === 'object' && 'code' in cause
+        ? String(cause.code || '').toUpperCase()
+        : '';
     if (/abort|timeout|timed?\s*out/i.test(message)) {
         return `ScaleMax request timed out after ${timeoutSeconds} seconds. Please try again.`;
     }
+    if (code === 'ENOTFOUND' || code === 'EAI_AGAIN') {
+        return 'Could not resolve the ScaleMax API hostname. Check this device’s DNS settings, then retry.';
+    }
+    if (/CERT|TLS|SSL|SELF_SIGNED|UNABLE_TO_VERIFY/.test(code)) {
+        return 'The ScaleMax TLS certificate could not be verified. Check the system clock and any HTTPS-inspecting proxy or antivirus, then retry.';
+    }
     // Native fetch intentionally hides DNS/TLS/proxy details behind the generic
     // "fetch failed" message. It is not an authentication verdict and may
     // contain environment-specific detail that is not useful in an installer.
@@ -90,6 +127,8 @@ async function request(path, apiKey, init = {}, retryGet = false, baseUrl = SCAL
     if (apiKey)
         headers.set('Authorization', `Bearer ${sanitizeApiKey(apiKey)}`);
     headers.set('Cache-Control', 'no-cache');
+    headers.set('Accept', 'application/json');
+    headers.set('User-Agent', 'ScaleMax-CLI');
     if (!headers.has('Content-Type') && init.body)
         headers.set('Content-Type', 'application/json');
     const attempts = retryGet && (!init.method || init.method === 'GET') ? 2 : 1;
@@ -98,7 +137,7 @@ async function request(path, apiKey, init = {}, retryGet = false, baseUrl = SCAL
         const timeout = AbortSignal.timeout(timeoutMs);
         const signal = init.signal && typeof AbortSignal.any === 'function' ? AbortSignal.any([init.signal, timeout]) : timeout;
         try {
-            const response = await fetch(`${baseUrl}${path}`, { ...init, headers, signal });
+            const response = await scaleMaxFetch(`${baseUrl}${path}`, { ...init, headers, signal }, attempt > 0);
             if (attempt + 1 === attempts || !retryableStatus(response.status))
                 return response;
             await response.body?.cancel().catch(() => undefined);

package/dist/utils/fs.js

@@ -7,7 +7,15 @@ export async function exists(p) { return fs.pathExists(p); }
 export async function syncParentDirectory(directory, platform = process.platform) {
     // Windows does not support fsync on directory handles and commonly returns EPERM.
     // The file itself is still fsynced before the atomic rename on every platform.
-    if (platform === 'win32')
+    //
+    // BOTH the injected platform and the REAL host are checked. The parameter
+    // exists so a test can simulate another OS's config layout, but fsync on a
+    // directory handle is a property of the machine actually running, not of the
+    // OS being simulated — so simulating linux on a Windows host made 49 tests
+    // fail with EPERM on a syscall that host can never support. Guarding on the
+    // host too costs Linux nothing: there process.platform is not 'win32', so the
+    // durability fsync still runs exactly as before.
+    if (platform === 'win32' || process.platform === 'win32')
         return;
     const dir = await fsp.open(directory, 'r');
     try {

package/dist/utils/network.d.ts

@@ -0,0 +1,5 @@
+import { type Dispatcher } from 'undici';
+export type ScaleMaxFetchInit = RequestInit & {
+    dispatcher: Dispatcher;
+};
+export declare function scaleMaxFetch(input: string | URL, init?: RequestInit, allowProxyFallback?: boolean): Promise<Response>;

package/dist/utils/network.js

@@ -0,0 +1,91 @@
+import { Agent, ProxyAgent } from 'undici';
+/*
+ * Node's built-in fetch does not consistently honor HTTP(S)_PROXY/NO_PROXY
+ * across the supported Node 18-22 range. It can also wait on an unusable
+ * IPv6 route instead of trying the working IPv4 address. The CLI is a
+ * network installer, so use an explicit dispatcher that handles both cases.
+ *
+ * RFC 8305-style family selection races the available A/AAAA routes instead
+ * of assuming the first DNS result is usable. ProxyAgent is used explicitly
+ * rather than Undici's experimental EnvHttpProxyAgent so customers do not see
+ * runtime stability warnings.
+ */
+const directDispatcher = new Agent({
+    autoSelectFamily: true,
+    autoSelectFamilyAttemptTimeout: 250
+});
+const proxyDispatchers = new Map();
+const proxyPreferredOrigins = new Set();
+function environmentValue(lowercase, uppercase) {
+    return String(process.env[lowercase] || process.env[uppercase] || '').trim();
+}
+function defaultPort(url) {
+    return url.port || (url.protocol === 'https:' ? '443' : '80');
+}
+function splitNoProxyEntry(entry) {
+    const value = entry.trim().toLowerCase();
+    if (value.startsWith('[')) {
+        const end = value.indexOf(']');
+        if (end >= 0) {
+            const port = value.slice(end + 1).replace(/^:/, '') || undefined;
+            return { hostname: value.slice(1, end), port };
+        }
+    }
+    const colon = value.lastIndexOf(':');
+    if (colon > -1 && value.indexOf(':') === colon && /^\d+$/.test(value.slice(colon + 1))) {
+        return { hostname: value.slice(0, colon), port: value.slice(colon + 1) };
+    }
+    return { hostname: value };
+}
+function bypassesProxy(url) {
+    const raw = environmentValue('no_proxy', 'NO_PROXY');
+    if (!raw)
+        return false;
+    const hostname = url.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    const port = defaultPort(url);
+    return raw.split(/[,\s]+/).filter(Boolean).some(candidate => {
+        if (candidate === '*')
+            return true;
+        const parsed = splitNoProxyEntry(candidate);
+        if (parsed.port && parsed.port !== port)
+            return false;
+        const rule = parsed.hostname.replace(/^\*\./, '').replace(/^\./, '');
+        return hostname === rule || hostname.endsWith(`.${rule}`);
+    });
+}
+function proxyFor(url) {
+    if (bypassesProxy(url))
+        return undefined;
+    if (url.protocol === 'https:') {
+        return environmentValue('https_proxy', 'HTTPS_PROXY')
+            || environmentValue('http_proxy', 'HTTP_PROXY')
+            || undefined;
+    }
+    return environmentValue('http_proxy', 'HTTP_PROXY') || undefined;
+}
+function dispatcherFor(url) {
+    const proxy = proxyFor(url);
+    if (!proxy)
+        return directDispatcher;
+    let dispatcher = proxyDispatchers.get(proxy);
+    if (!dispatcher) {
+        dispatcher = new ProxyAgent({
+            uri: proxy,
+            autoSelectFamily: true,
+            autoSelectFamilyAttemptTimeout: 250
+        });
+        proxyDispatchers.set(proxy, dispatcher);
+    }
+    return dispatcher;
+}
+export async function scaleMaxFetch(input, init = {}, allowProxyFallback = false) {
+    const url = input instanceof URL ? input : new URL(input);
+    const proxy = proxyFor(url);
+    const useProxy = Boolean(proxy)
+        && (allowProxyFallback || proxyPreferredOrigins.has(url.origin));
+    const dispatcher = useProxy ? dispatcherFor(url) : directDispatcher;
+    const response = await fetch(input, { ...init, dispatcher });
+    if (useProxy)
+        proxyPreferredOrigins.add(url.origin);
+    return response;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scalemax",
-  "version": "0.1.34",
+  "version": "0.1.36",
   "description": "Universal ScaleMax installer for AI coding clients",
   "type": "module",
   "bin": {
@@ -33,6 +33,7 @@
     "fs-extra": "^11.2.0",
     "json5": "^2.2.3",
     "ora": "^8.1.1",
+    "undici": "^6.28.0",
     "yaml": "^2.9.0"
   },
   "devDependencies": {