scalemax 0.1.47 → 0.1.49

package/README.md

@@ -78,6 +78,7 @@ scalemax doctor       Run diagnostics
 scalemax models       List available ScaleMax models
 scalemax helper-bot   Open the ScaleMax-only support assistant
 scalemax claude-tools Install bounded GitHub skill tools for Claude
+scalemax fix-roo      Fix Roo Code stuck at "API Request…" on recent VS Code
 scalemax update       Reconfigure detected clients with the stored key
 scalemax remove       Remove ScaleMax-generated client configuration
 scalemax --help       Show help
@@ -172,6 +173,8 @@ ScaleMax creates family-specific Hermes providers in `~/.hermes/config.yaml` and
 
 Roo Code stores provider profiles and secrets in VS Code extension storage, so ScaleMax does not mutate its private database. Instead, the CLI writes a private `0600` Roo settings-import file at `~/.scalemax/roo-code-import.json` and points the supported `roo-cline.autoImportSettingsPath` VS Code setting at it. Codex, Claude, and tool-capable DeepSeek profiles remain separate. DeepSeek is offered only when authenticated discovery reports `capabilities.tools=true`; otherwise Roo fails closed and points the user to Continue Chat/Edit. Reload VS Code once so Roo imports supported profiles into its SecretStorage. CLI verification intentionally reports the handoff as verified, not the extension runtime, until that reload occurs.
 
+Roo Code 3.54 (its latest release) looks for ripgrep only in folders newer VS Code releases no longer use, so on recent VS Code versions every task hangs at "API Request…" with "Could not find ripgrep binary". Configuring Roo Code also patches the installed extension's `dist/extension.js` (in the editor's per-user extensions folder, never the VS Code app) so it tries `node_modules.asar.unpacked/@vscode/ripgrep-universal/bin/<platform>-<arch>/` first and then its original folders. The untouched file is kept once as `extension.js.scalemax-orig`. Run `npx scalemax@latest fix-roo` to apply only this fix (VS Code, Insiders, Cursor, Windsurf, VSCodium, Trae, Kiro, and remote servers), `scalemax fix-roo --undo` to restore the original, and reload VS Code afterwards. `scalemax doctor` flags installs that still need it.
+
 ### Cline (CLI and VS Code)
 
 ScaleMax supports the verified Cline CLI `3.0.47` and VS Code extension `4.0.12` formats. The CLI surface uses Cline's built-in `openai-native` provider and Responses protocol. The extension uses its built-in OpenAI-compatible provider. Both receive the raw ScaleMax key and the matching credit or token base URL; ScaleMax never writes a custom `Authorization` or `x-api-key` header because Cline generates `Authorization: Bearer …` itself. Configuration is attempted only while Cline and VS Code are stopped, preserves unrelated state, uses private atomic files with backups and rollback, and fails closed on unknown versions or malformed/symlinked state.

package/dist/commands/configure.js

@@ -209,6 +209,8 @@ export async function configureCommand(opts = {}) {
             const ctx = { ...baseCtx, apiKey, baseUrl: selectedBaseUrl, providerScope, models: keyInfo.models, interactive: Boolean(process.stdin.isTTY), allowAppModification };
             const res = await client.configure(ctx);
             spinner.succeed(`${client.name} ${res.message}`);
+            if (res.note)
+                console.log(chalk.dim(`  ${res.note}`));
             if (client.verify) {
                 const verify = ora(`Verifying ${client.name}`).start();
                 try {

package/dist/commands/doctor.d.ts

@@ -1 +1,8 @@
+/**
+ * Roo Code 3.54 cannot find newer VS Code's relocated ripgrep, so every task
+ * hangs at "API Request…". Read-only: reports installs that still need
+ * `scalemax fix-roo`. A warning, not a failure, because older VS Code builds
+ * still work unpatched.
+ */
+export declare function rooRipgrepDoctorLines(home: string): Promise<string[]>;
 export declare function doctorCommand(home?: string): Promise<void>;

package/dist/commands/doctor.js

@@ -6,6 +6,26 @@ import { validateApiKey, testStreaming } from '../utils/api.js';
 import { homeDir } from '../utils/paths.js';
 import { clients } from '../clients.js';
 import { SCALEMAX_BASE_URL } from '../constants.js';
+import { repairRooRipgrep, rooInstallLabel } from '../repair/roo-ripgrep.js';
+/**
+ * Roo Code 3.54 cannot find newer VS Code's relocated ripgrep, so every task
+ * hangs at "API Request…". Read-only: reports installs that still need
+ * `scalemax fix-roo`. A warning, not a failure, because older VS Code builds
+ * still work unpatched.
+ */
+export async function rooRipgrepDoctorLines(home) {
+    const results = await repairRooRipgrep(home, { dryRun: true });
+    return results.map(result => {
+        const label = rooInstallLabel(result);
+        if (result.status === 'patched')
+            return `${chalk.yellow('!')} ${label} cannot find ripgrep on recent VS Code, so tasks hang at "API Request…". Run ${chalk.bold('npx scalemax@latest fix-roo')}, then Developer: Reload Window.`;
+        if (result.status === 'already_patched')
+            return `${chalk.green('✓')} ${label} ripgrep fix for newer VS Code applied`;
+        if (result.status === 'unsupported')
+            return `${chalk.dim('•')} ${label} ripgrep lookup not recognised; fix-roo not needed`;
+        return `${chalk.yellow('!')} ${label} could not be checked for the ripgrep fix: ${result.error}`;
+    });
+}
 export async function doctorCommand(home = homeDir()) {
     let failures = 0;
     const key = await loadApiKey(home);
@@ -61,6 +81,8 @@ export async function doctorCommand(home = homeDir()) {
         else
             console.log(`${chalk.green('✓')} ${client.name} configured (${d.reason || 'detector confirmed'})`);
     }
+    for (const line of await rooRipgrepDoctorLines(home))
+        console.log(line);
     console.log('');
     if (failures === 0)
         console.log(chalk.green('Everything looks good!'));

package/dist/commands/fix-roo.d.ts

@@ -0,0 +1 @@
+export declare function fixRooCommand(args?: readonly string[], home?: string): Promise<void>;

package/dist/commands/fix-roo.js

@@ -0,0 +1,64 @@
+import chalk from 'chalk';
+import { repairRooRipgrep, restoreRooRipgrep, rooInstallLabel } from '../repair/roo-ripgrep.js';
+import { homeDir } from '../utils/paths.js';
+const RELOAD_HINT = 'Reload VS Code (Developer: Reload Window) so Roo Code picks up the fix.';
+export async function fixRooCommand(args = [], home = homeDir()) {
+    if (args.includes('--undo'))
+        return undoFixRoo(home);
+    const results = await repairRooRipgrep(home);
+    if (!results.length) {
+        console.log(chalk.yellow('! Roo Code is not installed in VS Code or a VS Code-based editor on this computer. Nothing to fix.'));
+        return;
+    }
+    console.log(chalk.dim(`Found ${results.length} Roo Code installation${results.length === 1 ? '' : 's'}.`));
+    let failures = 0;
+    for (const result of results) {
+        const label = rooInstallLabel(result);
+        if (result.status === 'patched') {
+            console.log(chalk.green(`✓ ${label}: patched — it now finds newer VS Code's ripgrep.`));
+            console.log(chalk.dim(`  Original saved as ${result.backup}`));
+        }
+        else if (result.status === 'already_patched') {
+            console.log(chalk.green(`✓ ${label}: already patched.`));
+        }
+        else if (result.status === 'unsupported') {
+            console.log(chalk.yellow(`! ${label}: ripgrep lookup not recognised; left unchanged (this version may not need the fix).`));
+        }
+        else {
+            failures++;
+            console.log(chalk.red(`✗ ${label}: could not patch ${result.script}: ${result.error}`));
+        }
+    }
+    if (results.some(result => result.status === 'patched' || result.status === 'already_patched'))
+        console.log(`\n${RELOAD_HINT}`);
+    if (failures)
+        throw new Error(`${failures} Roo Code installation${failures === 1 ? '' : 's'} could not be patched. Close VS Code and run \`npx scalemax@latest fix-roo\` again.`);
+}
+async function undoFixRoo(home) {
+    const results = await restoreRooRipgrep(home);
+    if (!results.length) {
+        console.log(chalk.yellow('! Roo Code is not installed in VS Code or a VS Code-based editor on this computer. Nothing to undo.'));
+        return;
+    }
+    let failures = 0;
+    for (const result of results) {
+        const label = rooInstallLabel(result);
+        if (result.status === 'restored')
+            console.log(chalk.green(`✓ ${label}: original extension restored.`));
+        else if (result.status === 'not_patched')
+            console.log(chalk.dim(`• ${label}: not patched; nothing to undo.`));
+        else {
+            failures++;
+            const reason = result.status === 'no_backup'
+                ? `no ScaleMax backup found next to ${result.script}`
+                : result.status === 'mismatch'
+                    ? `the extension changed after it was patched, so the backup at ${result.backup} was not applied`
+                    : result.error;
+            console.log(chalk.red(`✗ ${label}: ${reason}. Reinstall Roo Code to get a clean copy.`));
+        }
+    }
+    if (results.some(result => result.status === 'restored'))
+        console.log('\nReload VS Code (Developer: Reload Window) so Roo Code loads the original files.');
+    if (failures)
+        throw new Error(`${failures} Roo Code installation${failures === 1 ? '' : 's'} could not be restored.`);
+}

package/dist/commands/helper-bot.js

@@ -714,7 +714,7 @@ export function selectHelperModel(models, requested) {
             throw new Error(`Model "${requested}" is not available to this API key. Run \`scalemax models\` to see available models.`);
         return exact.id;
     }
-    const preferred = ['gpt-5.4', 'gpt-5.4-mini', 'claude-haiku-4-5-20251001', 'fable-5', 'gpt-5.6-terra', 'gpt-5.6-sol'];
+    const preferred = ['gpt-5.6-luna', 'claude-haiku-4-5-20251001', 'fable-5', 'gpt-5.6-terra', 'gpt-5.6-sol'];
     for (const id of preferred) {
         const match = models.find(model => model.id.toLowerCase() === id);
         if (match)
@@ -1020,6 +1020,8 @@ async function runOneHelperClientAction(kind, client, connection, home, requeste
     write(`→ Configuring ${client.name} with the authenticated stored key…`);
     const configured = await client.configure(ctx);
     write(`✓ ${client.name} ${configured.message}`);
+    if (configured.note)
+        write(`  ${configured.note}`);
     if (client.verify) {
         write(`→ Verifying ${client.name} configuration…`);
         try {

package/dist/commands/helper-docs.js

@@ -23,6 +23,12 @@ export const HELPER_DOC_SECTIONS = [
         keywords: ['roo', 'roo code', 'vscode', 'vs code', 'extension', 'visual studio code', 'deepseek'],
         content: `For Roo Code, the ScaleMax CLI writes a private settings import file at ~/.scalemax/roo-code-import.json and sets roo-cline.autoImportSettingsPath in VS Code User settings. Roo imports that profile after VS Code is reloaded. A DeepSeek V4 Flash profile is offered only when the authenticated catalog reports capabilities.tools=true. If the active route is text-only, Roo fails closed because its task loop requires tools and the helper recommends Continue Chat/Edit instead. The CLI can install the official Roo Code extension with code --install-extension RooVeterinaryInc.roo-cline when VS Code is detected. On Windows, helper-bot may install VS Code first with winget using the fixed Microsoft.VisualStudioCode package id, then install Roo, write the import handoff, and verify the files.`
     },
+    {
+        id: 'roo-code-ripgrep',
+        title: 'Roo Code stuck at API Request on recent VS Code versions',
+        keywords: ['ripgrep', 'stuck', 'hang', 'hangs', 'hanging', 'frozen', 'fix-roo'],
+        content: `Roo Code 3.54, its latest release, looks for VS Code's bundled ripgrep only in folders newer VS Code releases moved to node_modules.asar.unpacked/@vscode/ripgrep-universal/bin/<platform>-<arch>/, so on recent VS Code versions every Roo task hangs at "API Request..." with "Could not find ripgrep binary", whatever the model or provider; the ScaleMax key is fine. Fix: run npx scalemax@latest fix-roo, then Developer: Reload Window. It patches only the installed Roo Code extension in the home folder, keeps the original as extension.js.scalemax-orig, never changes the VS Code app, and fix-roo --undo restores it. Configuring Roo Code with the CLI applies the same fix and scalemax doctor reports installs that still need it. Alternatives: copy rg from that folder to <VS Code app>/resources/app/node_modules/@vscode/ripgrep/bin/ (removed by every VS Code update), or use Cline or Kilo Code.`
+    },
     {
         id: 'continue-deepseek',
         title: 'Continue setup for DeepSeek V4 Flash',

package/dist/configure/api-code.js

@@ -4,12 +4,12 @@ import { jsonConfig } from './templates.js';
 const id = 'api-code';
 const name = 'API Code';
 export async function configure(ctx) {
-    const file = clientConfigPath(id, ctx.home, ctx.platform);
+    const file = clientConfigPath(id, ctx.home, ctx.platform, ctx.env);
     const content = jsonConfig(name, '$SCALEMAX_API_KEY', ctx.baseUrl, { environment: { SCALEMAX_API_KEY: 'your ScaleMax API key', SCALEMAX_BASE_URL: ctx.baseUrl }, node: `import OpenAI from 'openai';\nconst client = new OpenAI({ apiKey: process.env.SCALEMAX_API_KEY, baseURL: '${ctx.baseUrl}' });`, python: `from openai import OpenAI\nclient = OpenAI(api_key='...', base_url='${ctx.baseUrl}')` });
     const result = await writeManagedConfig(ctx, id, name, file, content);
     return { ...result, message: 'API code examples written' };
 }
 export async function remove(ctx) {
-    const file = clientConfigPath(id, ctx.home, ctx.platform);
+    const file = clientConfigPath(id, ctx.home, ctx.platform, ctx.env);
     return removeManagedConfig(ctx, id, name, file);
 }

package/dist/configure/codex.d.ts

@@ -6,7 +6,23 @@ export interface CodexVerificationResult {
     configPath: string;
     authPath: string;
 }
-export declare function mergeCodexConfig(existing: string, baseUrl: string, model?: string, authHash?: string): string;
+export declare function mergeCodexConfig(existing: string, baseUrl: string, model?: string, authHash?: string, keyHash?: string): string;
+/**
+ * Take ScaleMax OUT of a config.toml, keeping everything else the user has --
+ * including what Codex or the user added after setup (trusted projects,
+ * notices, other providers).
+ *
+ * Ownership is read from the CONTENT, not only from the generated header: a
+ * Codex rewrite that drops comments still leaves `model_provider = "scalemax"`
+ * and the `[model_providers.scalemax]` table, and those must go. The three
+ * top-level keys are removed only while ScaleMax is still the provider; if the
+ * user switched provider after setup they are the user's.
+ */
+export declare function stripScaleMaxCodexConfig(existing: string): {
+    text: string;
+    found: boolean;
+    strippedTopLevel: boolean;
+};
 export declare function verifyCodexConfiguration(ctx: ConfigureContext): Promise<CodexVerificationResult>;
 export declare function install(ctx: InstallContext): Promise<ConfigureResult>;
 export declare function verify(ctx: ConfigureContext): Promise<ConfigureResult>;

package/dist/configure/codex.js

@@ -10,17 +10,29 @@ import { AUTO_MODEL_ID, preferredOpenAiResponsesModel } from './models.js';
 const id = 'codex';
 const name = 'Codex';
 const provider = 'scalemax';
-const fallbackModel = 'gpt-5.5';
+const fallbackModel = 'gpt-5.6-luna'; // gpt-5.5 retired 2026-09-30; same price
 const reasoningEffort = 'medium';
 const managedAuthHashPrefix = '# ScaleMax managed auth.json SHA-256: ';
+// Fingerprint of the API key setup wrote into auth.json. Unlike the auth.json
+// hash above it survives Codex rewriting auth.json (a token refresh, its own
+// serialisation), so remove() can still tell OUR key from one the user put
+// there later.
+const managedKeyHashPrefix = '# ScaleMax managed API key SHA-256: ';
+const modelsComment = '# ScaleMax models are loaded from the authenticated live model catalog.';
+// The top-level keys setup owns while ScaleMax is the provider. remove() puts
+// the user's pre-ScaleMax values for exactly these back from the backup.
+const managedTopLevelKey = /^(model|model_provider|model_reasoning_effort)\s*=/;
 function contentSha256(content) {
     return crypto.createHash('sha256').update(content, 'utf8').digest('hex');
 }
-function managedAuthHash(config) {
-    const marker = config.split(/\r?\n/).find(line => line.startsWith(managedAuthHashPrefix));
-    const hash = marker?.slice(managedAuthHashPrefix.length).trim();
+function markerHash(config, prefix) {
+    const marker = config.split(/\r?\n/).find(line => line.startsWith(prefix));
+    const hash = marker?.slice(prefix.length).trim();
     return hash && /^[a-f0-9]{64}$/.test(hash) ? hash : undefined;
 }
+function managedAuthHash(config) {
+    return markerHash(config, managedAuthHashPrefix);
+}
 function selectedModel(ctx) {
     if (!ctx.models) {
         // An auto-api key's ONLY model is `auto`; gpt-5.5 (the generic fallback
@@ -30,11 +42,22 @@ function selectedModel(ctx) {
     }
     return preferredOpenAiResponsesModel(ctx);
 }
-function scalemaxCodexBlock(baseUrl, model = fallbackModel, authHash) {
+function scalemaxCodexBlock(baseUrl, model = fallbackModel, authHash, keyHash) {
     const authMarker = authHash ? `${managedAuthHashPrefix}${authHash}\n` : '';
-    return `# ${GENERATED_HEADER}\n${authMarker}model = "${model}"\nmodel_provider = "${provider}"\nmodel_reasoning_effort = "${reasoningEffort}"\n# ScaleMax models are loaded from the authenticated live model catalog.\n\n[model_providers.${provider}]\nname = "ScaleMax"\nbase_url = "${baseUrl}"\nwire_api = "responses"\nrequires_openai_auth = true\n`;
+    const keyMarker = keyHash ? `${managedKeyHashPrefix}${keyHash}\n` : '';
+    return `# ${GENERATED_HEADER}\n${authMarker}${keyMarker}model = "${model}"\nmodel_provider = "${provider}"\nmodel_reasoning_effort = "${reasoningEffort}"\n${modelsComment}\n\n[model_providers.${provider}]\nname = "ScaleMax"\nbase_url = "${baseUrl}"\nwire_api = "responses"\nrequires_openai_auth = true\n`;
+}
+/** A line setup writes as a comment. Never user content, and never preserved. */
+function isManagedCommentLine(line) {
+    return line === `# ${GENERATED_HEADER}`
+        || line === modelsComment
+        || line.startsWith(managedAuthHashPrefix)
+        || line.startsWith(managedKeyHashPrefix);
 }
-export function mergeCodexConfig(existing, baseUrl, model = fallbackModel, authHash) {
+function isScaleMaxProviderSection(section) {
+    return section === `model_providers.${provider}` || section.startsWith(`model_providers.${provider}.`);
+}
+export function mergeCodexConfig(existing, baseUrl, model = fallbackModel, authHash, keyHash) {
     const preserved = [];
     let section = '';
     let skipScaleMaxProvider = false;
@@ -43,20 +66,94 @@ export function mergeCodexConfig(existing, baseUrl, model = fallbackModel, authH
         const sectionMatch = line.match(/^\[([^\]]+)\]$/);
         if (sectionMatch) {
             section = sectionMatch[1];
-            skipScaleMaxProvider = section === `model_providers.${provider}`;
+            skipScaleMaxProvider = isScaleMaxProviderSection(section);
             if (skipScaleMaxProvider)
                 continue;
         }
         if (skipScaleMaxProvider)
             continue;
-        if (!section && /^(model|model_provider|model_reasoning_effort)\s*=/.test(line))
+        if (!section && managedTopLevelKey.test(line))
             continue;
-        if (line === `# ${GENERATED_HEADER}` || line.startsWith(managedAuthHashPrefix))
+        // Includes the models comment: it used to be kept here, so every re-run of
+        // setup stacked one more copy of it into the preserved tail.
+        if (isManagedCommentLine(line))
             continue;
         preserved.push(raw);
     }
     const tail = preserved.join('\n').trim();
-    return `${scalemaxCodexBlock(baseUrl, model, authHash)}${tail ? `\n${tail}\n` : ''}`;
+    return `${scalemaxCodexBlock(baseUrl, model, authHash, keyHash)}${tail ? `\n${tail}\n` : ''}`;
+}
+/**
+ * Take ScaleMax OUT of a config.toml, keeping everything else the user has --
+ * including what Codex or the user added after setup (trusted projects,
+ * notices, other providers).
+ *
+ * Ownership is read from the CONTENT, not only from the generated header: a
+ * Codex rewrite that drops comments still leaves `model_provider = "scalemax"`
+ * and the `[model_providers.scalemax]` table, and those must go. The three
+ * top-level keys are removed only while ScaleMax is still the provider; if the
+ * user switched provider after setup they are the user's.
+ */
+export function stripScaleMaxCodexConfig(existing) {
+    const lines = existing.split(/\r?\n/);
+    let section = '';
+    let topProvider;
+    let found = false;
+    for (const raw of lines) {
+        const line = raw.trim();
+        const sectionMatch = line.match(/^\[([^\]]+)\]$/);
+        if (sectionMatch) {
+            section = sectionMatch[1];
+            if (isScaleMaxProviderSection(section))
+                found = true;
+            continue;
+        }
+        if (isManagedCommentLine(line))
+            found = true;
+        if (!section) {
+            const providerMatch = line.match(/^model_provider\s*=\s*"([^"]*)"/);
+            if (providerMatch)
+                topProvider = providerMatch[1];
+        }
+    }
+    const strippedTopLevel = topProvider === provider;
+    if (strippedTopLevel)
+        found = true;
+    if (!found)
+        return { text: existing, found: false, strippedTopLevel: false };
+    const kept = [];
+    section = '';
+    let skip = false;
+    for (const raw of lines) {
+        const line = raw.trim();
+        const sectionMatch = line.match(/^\[([^\]]+)\]$/);
+        if (sectionMatch) {
+            section = sectionMatch[1];
+            skip = isScaleMaxProviderSection(section);
+            if (skip)
+                continue;
+        }
+        if (skip)
+            continue;
+        if (!section && strippedTopLevel && managedTopLevelKey.test(line))
+            continue;
+        if (isManagedCommentLine(line))
+            continue;
+        kept.push(raw);
+    }
+    return { text: kept.join('\n').trim(), found: true, strippedTopLevel };
+}
+/** The pre-ScaleMax top-level model / model_provider / model_reasoning_effort lines of a backup. */
+function originalTopLevelLines(backup) {
+    const out = [];
+    for (const raw of backup.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (/^\[[^\]]+\]$/.test(line))
+            break;
+        if (managedTopLevelKey.test(line))
+            out.push(line);
+    }
+    return out;
 }
 function codexAuth(apiKey, existing = {}) {
     return JSON.stringify({ ...existing, auth_mode: 'apikey', OPENAI_API_KEY: apiKey }, null, 2) + '\n';
@@ -111,22 +208,99 @@ async function latestRestorableBackup(file, home) {
     }
     return undefined;
 }
-async function restoreOrRemove(file, ctx, managedOverride) {
+async function removeCodexConfig(file, ctx) {
     if (!(await fs.pathExists(file)))
         return { changed: false, message: 'no ScaleMax configuration found' };
     const current = await fs.readFile(file, 'utf8').catch(() => '');
-    const structurallyManaged = current.includes(GENERATED_HEADER)
-        || (file.endsWith('auth.json') && isManagedCodexAuth(current));
-    const managed = managedOverride ?? structurallyManaged;
-    if (!managed)
+    const stripped = stripScaleMaxCodexConfig(current);
+    if (!stripped.found)
+        return { changed: false, message: 'left unmanaged configuration unchanged' };
+    // Put back the user's own model settings from before setup (the first
+    // pre-ScaleMax backup) -- only when ScaleMax's were actually taken out.
+    let restoredTop = [];
+    if (stripped.strippedTopLevel) {
+        const backup = await latestRestorableBackup(file, ctx.home);
+        if (backup)
+            restoredTop = originalTopLevelLines(await fs.readFile(backup, 'utf8').catch(() => ''));
+    }
+    const next = [restoredTop.join('\n'), stripped.text].filter(Boolean).join('\n\n');
+    if (!next.trim()) {
+        await fs.remove(file);
+        return { changed: true, message: 'removed ScaleMax configuration' };
+    }
+    await atomicWrite(file, `${next}\n`, 0o600, ctx.platform);
+    return {
+        changed: true,
+        message: restoredTop.length
+            ? 'removed ScaleMax settings and restored your previous model settings'
+            : 'removed ScaleMax settings; your other settings were kept',
+    };
+}
+/**
+ * Take the ScaleMax credential OUT of auth.json.
+ *
+ * Owned when ANY of: the file is byte-identical to what setup wrote (auth
+ * hash marker); its key is the key the CLI has saved; its key matches the
+ * key fingerprint setup wrote into config.toml. The last two survive Codex
+ * rewriting the file -- a ChatGPT token refresh or its own serialisation --
+ * which the exact hash alone did not, and which left the ScaleMax key in
+ * place after "remove". A DIFFERENT key the user put there after setup is
+ * none of these, and is left alone.
+ *
+ * Only the two fields setup sets are touched: auth_mode and OPENAI_API_KEY go
+ * back to their pre-setup values from the backup, or away if there were none.
+ * Tokens and refresh times stay as Codex last wrote them (they are fresher
+ * than the backup). A file left with nothing in it is deleted.
+ */
+async function removeCodexAuth(file, ctx, ownership) {
+    if (!(await fs.pathExists(file)))
+        return { changed: false, message: 'no ScaleMax configuration found' };
+    const text = await fs.readFile(file, 'utf8').catch(() => '');
+    let current;
+    try {
+        const parsed = JSON.parse(text);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            throw new Error('not an object');
+        current = parsed;
+    }
+    catch {
         return { changed: false, message: 'left unmanaged configuration unchanged' };
-    const restore = await latestRestorableBackup(file, ctx.home);
-    if (restore) {
-        await atomicWrite(file, await fs.readFile(restore, 'utf8'), 0o600, ctx.platform);
-        return { changed: true, message: `restored backup ${restore}` };
     }
-    await fs.remove(file);
-    return { changed: true, message: 'removed ScaleMax configuration' };
+    const key = typeof current.OPENAI_API_KEY === 'string' ? current.OPENAI_API_KEY : undefined;
+    const owned = (ownership.authHash !== undefined && contentSha256(text) === ownership.authHash)
+        || (key !== undefined && typeof ctx.apiKey === 'string' && ctx.apiKey.length > 0 && key === ctx.apiKey)
+        || (key !== undefined && ownership.keyHash !== undefined && contentSha256(key) === ownership.keyHash)
+        || (ownership.authHash === undefined && ownership.keyHash === undefined && ownership.legacyStructural && isManagedCodexAuth(text));
+    if (!owned)
+        return { changed: false, message: 'left unmanaged configuration unchanged' };
+    let original;
+    const backup = await latestRestorableBackup(file, ctx.home);
+    if (backup) {
+        try {
+            const parsed = JSON.parse(await fs.readFile(backup, 'utf8'));
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+                original = parsed;
+        }
+        catch { /* an unreadable backup restores nothing */ }
+    }
+    const next = { ...current };
+    for (const field of ['auth_mode', 'OPENAI_API_KEY']) {
+        if (original && Object.prototype.hasOwnProperty.call(original, field))
+            next[field] = original[field];
+        else
+            delete next[field];
+    }
+    const meaningful = Object.values(next).some(value => value !== null && value !== undefined
+        && !(typeof value === 'object' && !Array.isArray(value) && Object.keys(value).length === 0));
+    if (!original && !meaningful) {
+        await fs.remove(file);
+        return { changed: true, message: 'removed ScaleMax configuration' };
+    }
+    await atomicWrite(file, JSON.stringify(next, null, 2) + '\n', 0o600, ctx.platform);
+    return {
+        changed: true,
+        message: original ? 'removed the ScaleMax key and restored your previous sign-in' : 'removed the ScaleMax key',
+    };
 }
 export async function verifyCodexConfiguration(ctx) {
     const configPath = codexConfigPath(ctx.home);
@@ -261,7 +435,7 @@ export async function configure(ctx) {
     }
     catch { }
     const nextAuth = codexAuth(ctx.apiKey, existingAuth);
-    const nextConfig = mergeCodexConfig(originalConfig, ctx.baseUrl, selectedModel(ctx), contentSha256(nextAuth));
+    const nextConfig = mergeCodexConfig(originalConfig, ctx.baseUrl, selectedModel(ctx), contentSha256(nextAuth), contentSha256(ctx.apiKey));
     const changed = originalConfig !== nextConfig || originalAuth !== nextAuth;
     const alreadyManaged = originalConfig.includes(GENERATED_HEADER);
     let verification;
@@ -312,24 +486,18 @@ export async function configure(ctx) {
 export async function remove(ctx) {
     const configPath = codexConfigPath(ctx.home);
     const authPath = codexAuthPath(ctx.home);
-    const [configText, authText] = await Promise.all([
-        fs.readFile(configPath, 'utf8').catch(() => ''),
-        fs.readFile(authPath, 'utf8').catch(() => ''),
-    ]);
-    const expectedAuthHash = managedAuthHash(configText);
-    // New generated configs bind ownership to the exact auth content. A hash
-    // mismatch means the user signed in or edited auth.json after setup, so
-    // removal must leave that current authentication state untouched. Legacy
-    // configs without the marker retain the conservative structural fallback.
-    const authManagedOverride = expectedAuthHash
-        ? contentSha256(authText) === expectedAuthHash
-        : configText.includes(GENERATED_HEADER)
-            ? undefined
-            : false;
+    // Read the ownership markers BEFORE config.toml is rewritten below.
+    const configText = await fs.readFile(configPath, 'utf8').catch(() => '');
+    const ownership = {
+        authHash: managedAuthHash(configText),
+        keyHash: markerHash(configText, managedKeyHashPrefix),
+        // Configs written before either marker existed: the original structural rule.
+        legacyStructural: configText.includes(GENERATED_HEADER),
+    };
     const snapshots = await captureFileSnapshots([configPath, authPath]);
     try {
-        const config = await restoreOrRemove(configPath, ctx);
-        const auth = await restoreOrRemove(authPath, ctx, authManagedOverride);
+        const config = await removeCodexConfig(configPath, ctx);
+        const auth = await removeCodexAuth(authPath, ctx, ownership);
         return {
             id,
             name,

package/dist/configure/models.js

@@ -15,9 +15,8 @@ const preferredOpenAi = [
     'gpt-5.6-sol',
     'gpt-6-sol',
     'gpt-6-luna',
-    'gpt-5.5',
-    'gpt-5.4',
-    'gpt-5.4-mini',
+    // gpt-5.5 / gpt-5.4 / gpt-5.4-mini retired 2026-09-30.
+    'gpt-5.6-luna',
     'gpt-5.3-codex',
     'codex-auto-review',
     // Gemini / Grok / Qwen ride the same OpenAI-compatible route, so they are
@@ -126,7 +125,8 @@ export function fastModel(ctx) {
 }
 export function fastOpenAiModel(ctx) {
     const ids = openAiModelIds(ctx);
-    return ids.find(id => id === 'gpt-5.4-mini')
+    return ids.find(id => id === 'gpt-5.6-luna')
+        || ids.find(id => id === 'gpt-6-luna')
         || ids.find(id => /(^|[-.])(mini|nano)([-.]|$)/i.test(id));
 }
 /** The lightweight model for an OpenAI-compatible chat client, if one exists. */

package/dist/configure/openclaw.js

@@ -117,7 +117,7 @@ async function scrubGeneratedPlaintextCredentials(ctx, files) {
     return changed;
 }
 export async function configure(ctx) {
-    const file = clientConfigPath(id, ctx.home, ctx.platform);
+    const file = clientConfigPath(id, ctx.home, ctx.platform, ctx.env);
     const credentialFile = secretPath(ctx.home);
     const userAgentFile = userAgentPath(ctx.home);
     const legacyFile = path.join(ctx.home, '.openclaw', 'config.json');
@@ -272,7 +272,7 @@ export async function configure(ctx) {
     }
 }
 export async function verify(ctx) {
-    const file = clientConfigPath(id, ctx.home, ctx.platform);
+    const file = clientConfigPath(id, ctx.home, ctx.platform, ctx.env);
     const config = await fs.readJson(file);
     const codex = config?.models?.providers?.[codexProviderName];
     const claude = config?.models?.providers?.[claudeProviderName];
@@ -319,7 +319,7 @@ export async function verify(ctx) {
     return { id, name, changed: false, path: file, message: `verified ${codexIds.length} Responses, ${deepSeekIds.length} ${chatLabel}, and ${claudeIds.length} Claude models` };
 }
 export async function remove(ctx) {
-    const file = clientConfigPath(id, ctx.home, ctx.platform);
+    const file = clientConfigPath(id, ctx.home, ctx.platform, ctx.env);
     if (!(await fs.pathExists(file))) {
         const removed = await removeClientSecret(secretPath(ctx.home), ctx);
         const removedUserAgent = await removeClientSecret(userAgentPath(ctx.home), ctx);

package/dist/configure/opencode.js

@@ -38,7 +38,7 @@ function providerConfig(ctx) {
     };
 }
 export async function configure(ctx) {
-    const file = clientConfigPath(id, ctx.home, ctx.platform);
+    const file = clientConfigPath(id, ctx.home, ctx.platform, ctx.env);
     const selected = `scalemax/${preferredChatCompletionsModel(ctx)}`;
     const quick = fastChatCompletionsModel(ctx);
     const credentialFile = secretPath(ctx.home);
@@ -78,7 +78,7 @@ export async function configure(ctx) {
     };
 }
 export async function verify(ctx) {
-    const file = clientConfigPath(id, ctx.home, ctx.platform);
+    const file = clientConfigPath(id, ctx.home, ctx.platform, ctx.env);
     const config = await fs.readJson(file);
     const provider = config?.provider?.scalemax;
     if (provider?.npm !== '@ai-sdk/openai-compatible' || provider?.options?.baseURL !== openAiBaseUrl(ctx.baseUrl) || provider?.options?.apiKey !== secretReference) {
@@ -98,7 +98,7 @@ export async function verify(ctx) {
     return { id, name, changed: false, path: file, message: `verified ${configured.length} ScaleMax models` };
 }
 export async function remove(ctx) {
-    const file = clientConfigPath(id, ctx.home, ctx.platform);
+    const file = clientConfigPath(id, ctx.home, ctx.platform, ctx.env);
     if (!(await fs.pathExists(file))) {
         const removed = await removeClientSecret(secretPath(ctx.home), ctx);
         return { id, name, changed: removed, path: file, message: removed ? 'removed orphaned ScaleMax OpenCode credential' : 'no ScaleMax configuration found' };

package/dist/configure/roo-code.js

@@ -5,6 +5,7 @@ import { atomicWrite, backupFile, captureFileSnapshots, restoreFileSnapshots, sn
 import { clientConfigPath } from './paths.js';
 import { anthropicModelIds, deepSeekChatModelIds, isDeepSeekChatModelId, modelName, modelSupportsTools, openAiBaseUrl, openAiResponsesModelIds, preferredAnthropicModel, preferredChatCompletionsModel, preferredOpenAiResponsesModel } from './models.js';
 import { isAnthropicModel } from '../utils/api.js';
+import { rooRipgrepRepairNote } from '../repair/roo-ripgrep.js';
 const id = 'roo-code';
 const name = 'Roo Code (VS Code)';
 const importSetting = 'roo-cline.autoImportSettingsPath';
@@ -149,6 +150,14 @@ function handoff(ctx) {
     }, null, 2) + '\n';
 }
 export async function configure(ctx) {
+    const result = await configureHandoff(ctx);
+    // Roo Code 3.54 cannot find newer VS Code's relocated ripgrep, so every task
+    // hangs at "API Request…" whatever the provider. Patch the installed
+    // extension too; this is non-fatal and independent of the handoff above.
+    const note = await rooRipgrepRepairNote(ctx.home);
+    return note ? { ...result, note } : result;
+}
+async function configureHandoff(ctx) {
     const settingsFile = clientConfigPath(id, ctx.home, ctx.platform, ctx.env);
     const profileFile = importPath(ctx.home);
     const snapshots = await captureFileSnapshots([settingsFile, profileFile]);

package/dist/configure/templates.js

@@ -11,7 +11,7 @@ export function jsonConfig(client, apiKey, baseUrl, extra = {}) {
     }, null, 2) + '\n';
 }
 export function continueConfig(apiKey, baseUrl) {
-    const models = ['gpt-6-astra', 'gpt-6-sol', 'gpt-6-luna', 'gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.5', 'gpt-5.4', 'gpt-5.4-mini', 'gpt-5.3-codex', 'codex-auto-review', 'deepseek-v4-flash'];
+    const models = ['gpt-6-astra', 'gpt-6-sol', 'gpt-6-luna', 'gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna', 'gpt-5.3-codex', 'codex-auto-review', 'deepseek-v4-flash'];
     return JSON.stringify({
         models: models.map(model => ({
             title: model === 'deepseek-v4-flash' ? 'ScaleMax DeepSeek V4 Flash' : `ScaleMax ${model}`,
@@ -21,7 +21,7 @@ export function continueConfig(apiKey, baseUrl) {
             apiKey,
             ...(model === 'deepseek-v4-flash' ? { useResponsesApi: false } : {})
         })),
-        tabAutocompleteModel: { title: 'ScaleMax gpt-5.4-mini', provider: 'openai', model: 'gpt-5.4-mini', apiBase: baseUrl, apiKey },
+        tabAutocompleteModel: { title: 'ScaleMax gpt-5.6-luna', provider: 'openai', model: 'gpt-5.6-luna', apiBase: baseUrl, apiKey },
         contextProviders: [{ name: 'code' }, { name: 'docs' }, { name: 'diff' }, { name: 'terminal' }]
     }, null, 2) + '\n';
 }

package/dist/detect/roo-code.d.ts

@@ -1,2 +1,29 @@
 import { DetectContext, DetectionResult } from '../types/client.js';
+export declare const ROO_EXTENSION_PATTERN: RegExp;
+export interface EditorExtensionRoot {
+    /** Human label used in CLI output, e.g. "VS Code" or "Cursor". */
+    editor: string;
+    /** Path segments below the home folder. */
+    segments: readonly string[];
+}
+/**
+ * VS Code's own per-user extension folders. Detection stays limited to these
+ * because configure writes VS Code's settings.json, which forks do not read.
+ */
+export declare const VSCODE_EXTENSION_ROOTS: readonly EditorExtensionRoot[];
+/**
+ * Every per-user extension folder Roo Code can be installed into: VS Code,
+ * its forks, and their remote (SSH/WSL) servers. Used by repairs that fix the
+ * installed extension itself rather than writing editor settings.
+ */
+export declare const ALL_EDITOR_EXTENSION_ROOTS: readonly EditorExtensionRoot[];
+export interface RooExtensionDir {
+    editor: string;
+    /** Absolute extension folder, e.g. ~/.vscode/extensions/rooveterinaryinc.roo-cline-3.54.0 */
+    dir: string;
+    /** Version parsed from the folder name ("3.54.0"), when present. */
+    version?: string;
+}
+/** Roo Code extension folders under the given roots; missing roots are skipped. */
+export declare function findRooExtensionDirs(home: string, roots?: readonly EditorExtensionRoot[]): Promise<RooExtensionDir[]>;
 export declare function detect(ctx: DetectContext): Promise<DetectionResult>;

package/dist/detect/roo-code.js

@@ -3,20 +3,46 @@ import fs from 'fs-extra';
 import JSON5 from 'json5';
 import { commandExists } from '../utils/exec.js';
 import { clientConfigPath } from '../configure/paths.js';
-const extensionPattern = /^rooveterinaryinc\.roo-cline-/i;
-async function extensionPaths(home) {
-    const roots = [path.join(home, '.vscode', 'extensions'), path.join(home, '.vscode-insiders', 'extensions')];
+export const ROO_EXTENSION_PATTERN = /^rooveterinaryinc\.roo-cline-/i;
+/**
+ * VS Code's own per-user extension folders. Detection stays limited to these
+ * because configure writes VS Code's settings.json, which forks do not read.
+ */
+export const VSCODE_EXTENSION_ROOTS = [
+    { editor: 'VS Code', segments: ['.vscode', 'extensions'] },
+    { editor: 'VS Code Insiders', segments: ['.vscode-insiders', 'extensions'] },
+];
+/**
+ * Every per-user extension folder Roo Code can be installed into: VS Code,
+ * its forks, and their remote (SSH/WSL) servers. Used by repairs that fix the
+ * installed extension itself rather than writing editor settings.
+ */
+export const ALL_EDITOR_EXTENSION_ROOTS = [
+    ...VSCODE_EXTENSION_ROOTS,
+    { editor: 'Cursor', segments: ['.cursor', 'extensions'] },
+    { editor: 'Windsurf', segments: ['.windsurf', 'extensions'] },
+    { editor: 'VSCodium', segments: ['.vscode-oss', 'extensions'] },
+    { editor: 'VS Code Server', segments: ['.vscode-server', 'extensions'] },
+    { editor: 'Cursor Server', segments: ['.cursor-server', 'extensions'] },
+    { editor: 'Trae', segments: ['.trae', 'extensions'] },
+    { editor: 'Kiro', segments: ['.kiro', 'extensions'] },
+];
+/** Roo Code extension folders under the given roots; missing roots are skipped. */
+export async function findRooExtensionDirs(home, roots = VSCODE_EXTENSION_ROOTS) {
     const hits = [];
     for (const root of roots) {
-        const entries = await fs.readdir(root, { withFileTypes: true }).catch(() => []);
-        for (const entry of entries)
-            if (entry.isDirectory() && extensionPattern.test(entry.name))
-                hits.push(path.join(root, entry.name));
+        const rootDir = path.join(home, ...root.segments);
+        const entries = await fs.readdir(rootDir, { withFileTypes: true }).catch(() => []);
+        const names = entries.filter(entry => entry.isDirectory() && ROO_EXTENSION_PATTERN.test(entry.name)).map(entry => entry.name).sort();
+        for (const name of names) {
+            const version = name.replace(ROO_EXTENSION_PATTERN, '');
+            hits.push({ editor: root.editor, dir: path.join(rootDir, name), ...(version ? { version } : {}) });
+        }
     }
     return hits;
 }
 export async function detect(ctx) {
-    const paths = await extensionPaths(ctx.home);
+    const paths = (await findRooExtensionDirs(ctx.home)).map(hit => hit.dir);
     const executable = await commandExists('code', ctx.env);
     if (executable)
         paths.unshift('command:code');
@@ -31,6 +57,6 @@ export async function detect(ctx) {
         }
         catch { }
     }
-    const installed = paths.some(entry => entry === 'command:code' || extensionPattern.test(path.basename(entry)));
+    const installed = paths.some(entry => entry === 'command:code' || ROO_EXTENSION_PATTERN.test(path.basename(entry)));
     return { id: 'roo-code', name: 'Roo Code (VS Code)', installed, configured, executable, reason: installed ? undefined : 'Roo Code extension was not detected', paths };
 }

package/dist/index.js

@@ -13,6 +13,7 @@ import { updateCommand } from './commands/update.js';
 import { removeCommand } from './commands/remove.js';
 import { helperBotCommand } from './commands/helper-bot.js';
 import { claudeToolsCommand } from './commands/claude-tools.js';
+import { fixRooCommand } from './commands/fix-roo.js';
 import { ensureInstallerApiKey } from './utils/installerConfig.js';
 import { MIN_NODE, isNodeSupported, nodeUpgradeHint } from './utils/runtime.js';
 import { runSystemAudit } from './utils/systemAudit.js';
@@ -38,6 +39,10 @@ function printHelp(command) {
         console.log('Usage: scalemax helper-bot [--model <id>] ["question"]\n\nExecute safe ScaleMax setup and verification actions, or open the ScaleMax-only troubleshooting assistant.');
         return;
     }
+    if (command === 'fix-roo') {
+        console.log('Usage: scalemax fix-roo [--undo]\n\nFix Roo Code tasks stuck at "API Request…" on recent VS Code versions ("Could not find ripgrep binary").\nPatches the installed Roo Code extension in your home folder (VS Code, Insiders, Cursor, Windsurf,\nVSCodium, Trae, Kiro, and remote servers) so it finds VS Code\'s relocated ripgrep. The VS Code app\nitself is not changed. The original extension file is kept next to it as extension.js.scalemax-orig.\nReload VS Code (Developer: Reload Window) afterwards.\n\n  --undo  Restore the original Roo Code extension files');
+        return;
+    }
     const details = { update: 'Revalidate the API key and reconfigure every detected client.', remove: 'Restore backups or remove only ScaleMax-managed client configuration.', doctor: 'Validate the API key and verify detected client configuration.', models: 'List models available to the stored API key.', login: 'Store or replace the ScaleMax API key.', logout: 'Remove the locally stored ScaleMax API key.', 'claude-tools': 'Install and verify bounded public-GitHub skill tools for Claude Desktop/Cowork and Claude Code.' };
     if (command && details[command]) {
         console.log(`Usage: scalemax ${command}\n\n${details[command]}`);
@@ -55,6 +60,7 @@ Commands:
   scalemax models     List available models
   scalemax helper-bot Execute setup actions or open the ScaleMax Helper
   scalemax claude-tools Install bounded GitHub skill tools for Claude
+  scalemax fix-roo    Fix Roo Code stuck at "API Request…" (recent VS Code)
   scalemax update     Reconfigure detected clients
   scalemax remove     Remove ScaleMax-generated configs
   scalemax --version  Show installed version
@@ -86,7 +92,8 @@ async function main() {
             printHelp(command);
             return;
         }
-        if (command !== 'helper-bot' && args.length)
+        const allowedOptions = { 'fix-roo': ['--undo'] };
+        if (command !== 'helper-bot' && args.some(arg => !(allowedOptions[command] || []).includes(arg)))
             throw new Error(`Unknown option for ${command}: ${args.join(' ')}`);
         switch (command) {
             case 'init':
@@ -111,6 +118,9 @@ async function main() {
             case 'claude-tools':
                 await claudeToolsCommand();
                 break;
+            case 'fix-roo':
+                await fixRooCommand(args);
+                break;
             case 'update':
                 await updateCommand();
                 break;

package/dist/repair/roo-ripgrep.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Roo Code (last release 3.54.0, 2026-05-15) finds ripgrep by probing fixed
+ * folders under `vscode.env.appRoot`. Its bundled dist/extension.js contains,
+ * minified (identifiers differ per build):
+ *
+ *   async function fne(t){let e=async r=>{let a=Uwe.join(t,r,S8i);return await Ln(a)?a:void 0};
+ *     return await e("node_modules/@vscode/ripgrep/bin/")||await e("node_modules/vscode-ripgrep/bin")||...}
+ *
+ * Newer VS Code releases (seen on 1.138 and 1.140) moved its ripgrep to
+ * `<appRoot>/node_modules.asar.unpacked/@vscode/ripgrep-universal/bin/<platform>-<arch>/rg[.exe]`,
+ * so every probe misses, Roo throws "Could not find ripgrep binary" and every
+ * task hangs at "API Request…". We patch the user's INSTALLED extension (home
+ * folder, no admin rights) to try the new folders first and then fall through
+ * to the original probes, so older VS Code keeps working. The VS Code app
+ * bundle is never touched.
+ */
+export declare const ROO_RIPGREP_FIX_MARKER = "/*scalemax-rg-fix-1*/";
+export declare const ROO_RIPGREP_BACKUP_SUFFIX = ".scalemax-orig";
+export type RooRipgrepPatchStatus = 'patched' | 'already_patched' | 'unsupported';
+export interface RooRipgrepPatch {
+    status: RooRipgrepPatchStatus;
+    /** The rewritten source, or the input unchanged when nothing was patched. */
+    source: string;
+    /** How many ripgrep lookups were rewritten. */
+    occurrences: number;
+}
+/**
+ * Pure rewrite of Roo's minified ripgrep lookup. New candidate folders come
+ * first so newer VS Code resolves immediately; the original probes follow.
+ * Idempotent: patched text no longer matches, and the marker reports it.
+ */
+export declare function patchRooRipgrepSource(src: string): RooRipgrepPatch;
+export interface RooExtensionScript {
+    editor: string;
+    /** Roo Code version parsed from the extension folder name. */
+    version?: string;
+    extensionDir: string;
+    /** Absolute path of the extension's dist/extension.js. */
+    script: string;
+}
+/** Installed Roo Code bundles across VS Code, its forks, and remote servers. */
+export declare function findRooExtensionScripts(home: string): Promise<RooExtensionScript[]>;
+/** "Roo Code 3.54.0 (VS Code)" */
+export declare function rooInstallLabel(target: Pick<RooExtensionScript, 'editor' | 'version'>): string;
+export type RooRipgrepRepairStatus = RooRipgrepPatchStatus | 'error';
+export interface RooRipgrepRepairResult extends RooExtensionScript {
+    /** With `dryRun`, 'patched' means the bundle still needs the fix; nothing was written. */
+    status: RooRipgrepRepairStatus;
+    occurrences?: number;
+    /** Byte-exact copy of the bundle as it was before ScaleMax first patched it. */
+    backup?: string;
+    error?: string;
+}
+export interface RooRipgrepRepairOptions {
+    /** Report what would change without writing anything (used by `scalemax doctor`). */
+    dryRun?: boolean;
+}
+/**
+ * Patch every installed Roo Code bundle. Writes `extension.js.scalemax-orig`
+ * once (never overwritten), then replaces the bundle atomically. One bad file
+ * is reported, never thrown.
+ */
+export declare function repairRooRipgrep(home: string, opts?: RooRipgrepRepairOptions): Promise<RooRipgrepRepairResult[]>;
+export type RooRipgrepRestoreStatus = 'restored' | 'not_patched' | 'no_backup' | 'mismatch' | 'error';
+export interface RooRipgrepRestoreResult extends RooExtensionScript {
+    status: RooRipgrepRestoreStatus;
+    backup?: string;
+    error?: string;
+}
+/**
+ * Undo `repairRooRipgrep` from the backup. Restores only when re-patching the
+ * backup reproduces the current bundle exactly, so a bundle changed since (or
+ * a damaged backup) is never clobbered. The backup is removed once restored.
+ */
+export declare function restoreRooRipgrep(home: string): Promise<RooRipgrepRestoreResult[]>;
+/**
+ * One line for the Roo Code configure flow, or undefined when Roo Code is not
+ * installed in any editor. Never throws.
+ */
+export declare function rooRipgrepRepairNote(home: string): Promise<string | undefined>;

package/dist/repair/roo-ripgrep.js

@@ -0,0 +1,170 @@
+import path from 'node:path';
+import fsp from 'node:fs/promises';
+import { atomicWrite } from '../utils/fs.js';
+import { ALL_EDITOR_EXTENSION_ROOTS, findRooExtensionDirs } from '../detect/roo-code.js';
+/**
+ * Roo Code (last release 3.54.0, 2026-05-15) finds ripgrep by probing fixed
+ * folders under `vscode.env.appRoot`. Its bundled dist/extension.js contains,
+ * minified (identifiers differ per build):
+ *
+ *   async function fne(t){let e=async r=>{let a=Uwe.join(t,r,S8i);return await Ln(a)?a:void 0};
+ *     return await e("node_modules/@vscode/ripgrep/bin/")||await e("node_modules/vscode-ripgrep/bin")||...}
+ *
+ * Newer VS Code releases (seen on 1.138 and 1.140) moved its ripgrep to
+ * `<appRoot>/node_modules.asar.unpacked/@vscode/ripgrep-universal/bin/<platform>-<arch>/rg[.exe]`,
+ * so every probe misses, Roo throws "Could not find ripgrep binary" and every
+ * task hangs at "API Request…". We patch the user's INSTALLED extension (home
+ * folder, no admin rights) to try the new folders first and then fall through
+ * to the original probes, so older VS Code keeps working. The VS Code app
+ * bundle is never touched.
+ */
+export const ROO_RIPGREP_FIX_MARKER = '/*scalemax-rg-fix-1*/';
+export const ROO_RIPGREP_BACKUP_SUFFIX = '.scalemax-orig';
+const LEGACY_LOOKUP = /return\s+await\s+([A-Za-z_$][\w$]*)\(\s*"node_modules\/@vscode\/ripgrep\/bin\/"\s*\)/g;
+const PLATFORM_FOLDER = '"+process.platform+"-"+process.arch+"/';
+function patchedLookup(probe) {
+    return `return await ${probe}(${ROO_RIPGREP_FIX_MARKER}"node_modules.asar.unpacked/@vscode/ripgrep-universal/bin/${PLATFORM_FOLDER}")`
+        + `||await ${probe}("node_modules/@vscode/ripgrep-universal/bin/${PLATFORM_FOLDER}")`
+        + `||await ${probe}("node_modules/@vscode/ripgrep/bin/")`;
+}
+/**
+ * Pure rewrite of Roo's minified ripgrep lookup. New candidate folders come
+ * first so newer VS Code resolves immediately; the original probes follow.
+ * Idempotent: patched text no longer matches, and the marker reports it.
+ */
+export function patchRooRipgrepSource(src) {
+    let occurrences = 0;
+    const source = src.replace(LEGACY_LOOKUP, (_match, probe) => {
+        occurrences++;
+        return patchedLookup(probe);
+    });
+    if (occurrences)
+        return { status: 'patched', source, occurrences };
+    return { status: src.includes(ROO_RIPGREP_FIX_MARKER) ? 'already_patched' : 'unsupported', source: src, occurrences: 0 };
+}
+/** Installed Roo Code bundles across VS Code, its forks, and remote servers. */
+export async function findRooExtensionScripts(home) {
+    const scripts = [];
+    for (const hit of await findRooExtensionDirs(home, ALL_EDITOR_EXTENSION_ROOTS)) {
+        const script = path.join(hit.dir, 'dist', 'extension.js');
+        const stat = await fsp.lstat(script).catch(() => undefined);
+        if (!stat)
+            continue;
+        scripts.push({ editor: hit.editor, ...(hit.version ? { version: hit.version } : {}), extensionDir: hit.dir, script });
+    }
+    return scripts;
+}
+/** "Roo Code 3.54.0 (VS Code)" */
+export function rooInstallLabel(target) {
+    return `Roo Code${target.version ? ` ${target.version}` : ''} (${target.editor})`;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+async function readRegularFile(file) {
+    const stat = await fsp.lstat(file);
+    if (!stat.isFile())
+        throw new Error(`refusing to modify a non-regular file: ${file}`);
+    return { bytes: await fsp.readFile(file), mode: stat.mode & 0o777 };
+}
+/** Bundles are handled as latin1 so every byte round-trips exactly; the inserted text is ASCII. */
+const asText = (bytes) => bytes.toString('latin1');
+const asBytes = (text) => Buffer.from(text, 'latin1');
+async function writeBackupOnce(backup, bytes, mode) {
+    try {
+        await fsp.writeFile(backup, bytes, { flag: 'wx', mode });
+    }
+    catch (error) {
+        // Never overwrite: an existing backup is the pristine pre-ScaleMax bundle.
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+}
+/**
+ * Patch every installed Roo Code bundle. Writes `extension.js.scalemax-orig`
+ * once (never overwritten), then replaces the bundle atomically. One bad file
+ * is reported, never thrown.
+ */
+export async function repairRooRipgrep(home, opts = {}) {
+    const results = [];
+    for (const target of await findRooExtensionScripts(home)) {
+        try {
+            const { bytes, mode } = await readRegularFile(target.script);
+            const patch = patchRooRipgrepSource(asText(bytes));
+            if (patch.status !== 'patched' || opts.dryRun) {
+                results.push({ ...target, status: patch.status, occurrences: patch.occurrences });
+                continue;
+            }
+            const backup = target.script + ROO_RIPGREP_BACKUP_SUFFIX;
+            await writeBackupOnce(backup, bytes, mode);
+            await atomicWrite(target.script, asBytes(patch.source), mode);
+            results.push({ ...target, status: 'patched', occurrences: patch.occurrences, backup });
+        }
+        catch (error) {
+            results.push({ ...target, status: 'error', error: errorMessage(error) });
+        }
+    }
+    return results;
+}
+/**
+ * Undo `repairRooRipgrep` from the backup. Restores only when re-patching the
+ * backup reproduces the current bundle exactly, so a bundle changed since (or
+ * a damaged backup) is never clobbered. The backup is removed once restored.
+ */
+export async function restoreRooRipgrep(home) {
+    const results = [];
+    for (const target of await findRooExtensionScripts(home)) {
+        const backup = target.script + ROO_RIPGREP_BACKUP_SUFFIX;
+        try {
+            const { bytes, mode } = await readRegularFile(target.script);
+            const current = asText(bytes);
+            if (!current.includes(ROO_RIPGREP_FIX_MARKER)) {
+                results.push({ ...target, status: 'not_patched' });
+                continue;
+            }
+            const original = await fsp.readFile(backup).catch((error) => {
+                if (error.code === 'ENOENT')
+                    return undefined;
+                throw error;
+            });
+            if (!original) {
+                results.push({ ...target, status: 'no_backup' });
+                continue;
+            }
+            if (patchRooRipgrepSource(asText(original)).source !== current) {
+                results.push({ ...target, status: 'mismatch', backup });
+                continue;
+            }
+            await atomicWrite(target.script, original, mode);
+            await fsp.rm(backup, { force: true });
+            results.push({ ...target, status: 'restored', backup });
+        }
+        catch (error) {
+            results.push({ ...target, status: 'error', backup, error: errorMessage(error) });
+        }
+    }
+    return results;
+}
+/**
+ * One line for the Roo Code configure flow, or undefined when Roo Code is not
+ * installed in any editor. Never throws.
+ */
+export async function rooRipgrepRepairNote(home) {
+    let results;
+    try {
+        results = await repairRooRipgrep(home);
+    }
+    catch (error) {
+        return `Roo Code ripgrep fix skipped (${errorMessage(error)}); run \`npx scalemax@latest fix-roo\` to retry.`;
+    }
+    if (!results.length)
+        return undefined;
+    const failed = results.filter(result => result.status === 'error');
+    if (failed.length)
+        return `Could not apply the Roo Code ripgrep fix (${failed[0].error}); run \`npx scalemax@latest fix-roo\` for details.`;
+    if (results.some(result => result.status === 'patched'))
+        return 'Patched Roo Code to find newer VS Code\'s ripgrep (fixes tasks stuck at "API Request…"); reload VS Code to apply.';
+    if (results.some(result => result.status === 'already_patched'))
+        return 'Roo Code\'s ripgrep fix for newer VS Code is already applied.';
+    return 'Roo Code\'s ripgrep lookup was not recognised, so no ripgrep fix was applied (this Roo Code version may not need it).';
+}

package/dist/types/client.d.ts

@@ -75,6 +75,12 @@ export interface ConfigureResult {
     message: string;
     /** One-line usage advice printed after a successful configure (e.g. which agent mode can run tools). */
     tip?: string;
+    /**
+     * One-line report of a side repair made while configuring (e.g. the Roo Code
+     * ripgrep fix). Printed right after the configure step, before verification,
+     * because the repair stands even if the configuration is later rolled back.
+     */
+    note?: string;
     /** Restore the exact state captured immediately before this configure call. */
     rollback?: () => Promise<void>;
 }

package/dist/utils/fs.d.ts

@@ -1,6 +1,6 @@
 export declare function exists(p: string): Promise<boolean>;
 export declare function syncParentDirectory(directory: string, platform?: NodeJS.Platform): Promise<void>;
-export declare function atomicWrite(file: string, content: string, mode?: number, platform?: NodeJS.Platform): Promise<void>;
+export declare function atomicWrite(file: string, content: string | Uint8Array, mode?: number, platform?: NodeJS.Platform): Promise<void>;
 export declare function backupNameFor(file: string): string;
 export declare function backupFile(file: string, home: string): Promise<string | undefined>;
 export declare function listBackups(file: string, home: string): Promise<string[]>;

package/dist/utils/fs.js

@@ -34,7 +34,8 @@ export async function atomicWrite(file, content, mode = 0o600, platform = proces
     let handle;
     try {
         handle = await fsp.open(tmp, 'wx', mode);
-        await handle.writeFile(content, 'utf8');
+        // Strings are written as UTF-8; byte content (e.g. a patched bundle) is written verbatim.
+        await handle.writeFile(content, typeof content === 'string' ? 'utf8' : undefined);
         await handle.sync();
         await handle.close();
         handle = undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scalemax",
-  "version": "0.1.47",
+  "version": "0.1.49",
   "description": "Universal ScaleMax installer for AI coding clients",
   "type": "module",
   "bin": {