refactor(auth): unify OAuth credentials into config.json

Move OAuth tokens from a separate ~/.mmx/credentials.json file into an
'oauth' subobject inside the existing ~/.mmx/config.json. Single source
of truth for all CLI state, simpler logout, one file to back up.

Also makes Config.oauthApiHost optional and derives it lazily via a new
oauthApiHostFor(config) helper, removing the cascade of test-fixture
churn that adding it as a required field would have caused.

Author: kapelame

src/auth/credentials.ts

@@ -1,51 +1,34 @@
-import { readFileSync, writeFileSync, renameSync, unlinkSync, existsSync, statSync } from 'fs';
-import { getCredentialsPath, ensureConfigDir } from '../config/paths';
+import { readConfigFile, writeConfigFile } from '../config/loader';
 import type { CredentialFile } from './types';
 
-export async function loadCredentials(): Promise<CredentialFile | null> {
-  const path = getCredentialsPath();
-  if (!existsSync(path)) return null;
+/**
+ * OAuth credentials live inside the user's main config file
+ * (`~/.mmx/config.json`) under the `oauth` subobject. This keeps a
+ * single source of truth for all CLI state.
+ */
 
-  try {
-    checkPermissions(path);
-    const raw = readFileSync(path, 'utf-8');
-    const data = JSON.parse(raw) as CredentialFile;
-    if (!data.access_token || !data.refresh_token) return null;
-    return data;
-  } catch (err) {
-    const e = err as Error;
-    if (e instanceof SyntaxError || e.message.includes('JSON')) {
-      process.stderr.write(`Warning: credentials file is corrupted. Run 'mmx auth logout' to reset.\n`);
-    }
-    return null;
-  }
+export async function loadCredentials(): Promise<CredentialFile | null> {
+  const cfg = readConfigFile();
+  if (!cfg.oauth) return null;
+  return {
+    access_token: cfg.oauth.access_token,
+    refresh_token: cfg.oauth.refresh_token,
+    expires_at: cfg.oauth.expires_at,
+    token_type: cfg.oauth.token_type,
+    resource_url: cfg.oauth.resource_url,
+    account: cfg.oauth.account,
+  };
 }
 
 export async function saveCredentials(creds: CredentialFile): Promise<void> {
-  await ensureConfigDir();
-  const path = getCredentialsPath();
-  const tmp = path + '.tmp';
-  writeFileSync(tmp, JSON.stringify(creds, null, 2) + '\n', { mode: 0o600 });
-  renameSync(tmp, path);
+  const existing = readConfigFile() as Record<string, unknown>;
+  existing.oauth = creds;
+  await writeConfigFile(existing);
 }
 
 export async function clearCredentials(): Promise<void> {
-  const path = getCredentialsPath();
-  if (existsSync(path)) {
-    unlinkSync(path);
-  }
-}
-
-function checkPermissions(path: string): void {
-  try {
-    const stat = statSync(path);
-    const mode = stat.mode & 0o777;
-    if (mode !== 0o600) {
-      process.stderr.write(
-        `Warning: ${path} has permissions ${mode.toString(8)}, expected 600.\n`,
-      );
-    }
-  } catch {
-    // Ignore permission check errors on platforms that don't support it
-  }
+  const existing = readConfigFile() as Record<string, unknown>;
+  if (!('oauth' in existing)) return;
+  delete existing.oauth;
+  await writeConfigFile(existing);
 }

src/auth/resolver.ts

@@ -1,4 +1,5 @@
 import type { Config } from '../config/schema';
+import { oauthApiHostFor } from '../config/schema';
 import type { ResolvedCredential } from './types';
 import { loadCredentials } from './credentials';
 import { ensureFreshToken } from './refresh';
@@ -11,11 +12,11 @@ export async function resolveCredential(config: Config): Promise<ResolvedCredent
     return { token: config.apiKey, method: 'api-key', source: 'flag' };
   }
 
-  // 2. OAuth credentials file
+  // 2. OAuth credentials in config file
   const oauth = await loadCredentials();
   if (oauth) {
-    const token = await ensureFreshToken(oauth, `${config.oauthApiHost}/oauth2/token`);
-    return { token, method: 'oauth', source: 'credentials.json' };
+    const token = await ensureFreshToken(oauth, `${oauthApiHostFor(config)}/oauth2/token`);
+    return { token, method: 'oauth', source: 'config.json' };
   }
 
   // 3. API key from config file

src/auth/setup.ts

@@ -1,4 +1,5 @@
 import type { Config } from '../config/schema';
+import { oauthApiHostFor } from '../config/schema';
 import { readConfigFile, writeConfigFile } from '../config/loader';
 import { promptText, promptConfirm } from '../utils/prompt';
 import { isInteractive } from '../utils/env';
@@ -54,11 +55,12 @@ export async function ensureAuth(config: Config): Promise<void> {
     }
 
     if (method === 'oauth') {
+      const host = oauthApiHostFor(config);
       const oauthConfig: OAuthConfig = {
         clientId: '659cf4c1-615c-45f6-a5f6-4bf15eb476e5',
         clientName: 'MiniMax CLI',
-        tokenUrl: `${config.oauthApiHost}/oauth2/token`,
-        deviceCodeUrl: `${config.oauthApiHost}/oauth2/device/code`,
+        tokenUrl: `${host}/oauth2/token`,
+        deviceCodeUrl: `${host}/oauth2/device/code`,
         scopes: ['openid', 'profile', 'coding_plan'],
       };
       const tokens = await startDeviceCodeFlow(oauthConfig);

src/commands/auth/login.ts

@@ -154,7 +154,7 @@ export default defineCommand({
 
     await saveCredentials(creds);
     process.stderr.write('Logged in successfully.\n');
-    process.stderr.write('Credentials saved to ~/.mmx/credentials.json\n');
+    process.stderr.write('Credentials saved to ~/.mmx/config.json\n');
 
     await showQuotaAfterLogin({ ...config, apiKey: creds.access_token });
   },

src/commands/auth/logout.ts

@@ -22,29 +22,28 @@ export default defineCommand({
     const hasConfigKey = !!fileConfig.api_key;
 
     if (config.dryRun) {
-      if (creds) console.log('Would remove ~/.mmx/credentials.json');
+      if (creds) console.log('Would clear oauth from ~/.mmx/config.json');
       if (hasConfigKey) console.log('Would clear api_key from ~/.mmx/config.json');
       if (!creds && !hasConfigKey) console.log('No credentials to clear.');
       console.log('No changes made.');
       return;
     }
 
+    if (!creds && !hasConfigKey) {
+      process.stderr.write('No credentials to clear.\n');
+      return;
+    }
+
     if (creds) {
       await clearCredentials();
-      process.stderr.write('Removed ~/.mmx/credentials.json\n');
+      process.stderr.write('Cleared oauth from ~/.mmx/config.json\n');
     }
 
     if (hasConfigKey) {
-      try {
-        const updated = fileConfig as Record<string, unknown>;
-        delete updated.api_key;
-        await writeConfigFile(updated);
-        process.stderr.write('Cleared api_key from ~/.mmx/config.json\n');
-      } catch { /* ignore */ }
-    }
-
-    if (!creds && !hasConfigKey) {
-      process.stderr.write('No credentials to clear.\n');
+      const updated = readConfigFile() as Record<string, unknown>;
+      delete updated.api_key;
+      await writeConfigFile(updated);
+      process.stderr.write('Cleared api_key from ~/.mmx/config.json\n');
     }
   },
 });

src/commands/auth/refresh.ts

@@ -4,7 +4,7 @@ import { ExitCode } from '../../errors/codes';
 import { loadCredentials, saveCredentials } from '../../auth/credentials';
 import { refreshAccessToken } from '../../auth/refresh';
 import { formatOutput, detectOutputFormat } from '../../output/formatter';
-import type { Config } from '../../config/schema';
+import { oauthApiHostFor, type Config } from '../../config/schema';
 import type { GlobalFlags } from '../../types/flags';
 import type { CredentialFile } from '../../auth/types';
 
@@ -33,7 +33,7 @@ export default defineCommand({
 
     const tokens = await refreshAccessToken(
       creds.refresh_token,
-      `${config.oauthApiHost}/oauth2/token`,
+      `${oauthApiHostFor(config)}/oauth2/token`,
     );
 
     const updated: CredentialFile = {

src/config/loader.ts

@@ -1,6 +1,6 @@
 import { readFileSync, writeFileSync, renameSync, existsSync } from 'fs';
 import { parseConfigFile, REGIONS, OAUTH_API_HOSTS, type Config, type ConfigFile, type Region } from './schema';
-import { ensureConfigDir, getConfigPath, getCredentialsPath } from './paths';
+import { ensureConfigDir, getConfigPath } from './paths';
 import { detectOutputFormat, type OutputFormat } from '../output/formatter';
 import { CLIError } from '../errors/base';
 import { ExitCode } from '../errors/codes';
@@ -28,17 +28,6 @@ export async function writeConfigFile(data: Record<string, unknown>): Promise<vo
   renameSync(tmp, path);
 }
 
-function readCredentialResourceUrl(): string | undefined {
-  const path = getCredentialsPath();
-  if (!existsSync(path)) return undefined;
-  try {
-    const data = JSON.parse(readFileSync(path, 'utf-8'));
-    return data.resource_url || undefined;
-  } catch {
-    return undefined;
-  }
-}
-
 export function loadConfig(flags: GlobalFlags): Config {
   const file = readConfigFile();
 
@@ -63,7 +52,7 @@ export function loadConfig(flags: GlobalFlags): Config {
   const baseUrl = flags.baseUrl
     || process.env.MINIMAX_BASE_URL
     || file.base_url
-    || readCredentialResourceUrl()
+    || file.oauth?.resource_url
     || REGIONS[region]
     || REGIONS.global;
 

src/config/paths.ts

@@ -11,10 +11,6 @@ export function getConfigPath(): string {
   return join(getConfigDir(), 'config.json');
 }
 
-export function getCredentialsPath(): string {
-  return join(getConfigDir(), 'credentials.json');
-}
-
 export async function ensureConfigDir(): Promise<void> {
   const dir = getConfigDir();
   const fs = await import('fs/promises');

src/config/schema.ts

@@ -14,13 +14,28 @@ export const OAUTH_API_HOSTS: Record<Region, string> = {
   cn: 'https://account.minimaxi.com',
   global: 'https://account.minimax.io',
 };
+
+export function oauthApiHostFor(config: { region: Region; oauthApiHost?: string }): string {
+  return config.oauthApiHost || OAUTH_API_HOSTS[config.region];
+}
+
+export interface OAuthCredentials {
+  access_token: string;
+  refresh_token: string;
+  expires_at: string; // ISO 8601
+  token_type: 'Bearer';
+  resource_url?: string;
+  account?: string;
+}
+
 export interface ConfigFile {
   api_key?: string;
   region?: Region;
   base_url?: string;
   output?: 'text' | 'json';
   timeout?: number;
   proxy?: string;
+  oauth?: OAuthCredentials;
   default_text_model?: string;
   default_speech_model?: string;
   default_video_model?: string;
@@ -30,6 +45,23 @@ export interface ConfigFile {
 const VALID_REGIONS = new Set<string>(['global', 'cn']);
 const VALID_OUTPUTS = new Set<string>(['text', 'json']);
 
+function parseOAuth(raw: unknown): OAuthCredentials | undefined {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return undefined;
+  const o = raw as Record<string, unknown>;
+  if (typeof o.access_token !== 'string' || !o.access_token) return undefined;
+  if (typeof o.refresh_token !== 'string') return undefined;
+  if (typeof o.expires_at !== 'string') return undefined;
+  const out: OAuthCredentials = {
+    access_token: o.access_token,
+    refresh_token: o.refresh_token,
+    expires_at: o.expires_at,
+    token_type: 'Bearer',
+  };
+  if (typeof o.resource_url === 'string' && o.resource_url.length > 0) out.resource_url = o.resource_url;
+  if (typeof o.account === 'string' && o.account.length > 0) out.account = o.account;
+  return out;
+}
+
 export function parseConfigFile(raw: unknown): ConfigFile {
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {};
   const obj = raw as Record<string, unknown>;
@@ -41,6 +73,8 @@ export function parseConfigFile(raw: unknown): ConfigFile {
   if (typeof obj.output === 'string' && VALID_OUTPUTS.has(obj.output)) out.output = obj.output as ConfigFile['output'];
   if (typeof obj.timeout === 'number' && obj.timeout > 0) out.timeout = obj.timeout;
   if (typeof obj.proxy === 'string' && obj.proxy.startsWith('http')) out.proxy = obj.proxy;
+  const oauth = parseOAuth(obj.oauth);
+  if (oauth) out.oauth = oauth;
   if (typeof obj.default_text_model === 'string' && obj.default_text_model.length > 0) out.default_text_model = obj.default_text_model;
   if (typeof obj.default_speech_model === 'string' && obj.default_speech_model.length > 0) out.default_speech_model = obj.default_speech_model;
   if (typeof obj.default_video_model === 'string' && obj.default_video_model.length > 0) out.default_video_model = obj.default_video_model;
@@ -56,7 +90,7 @@ export interface Config {
   configPath?: string;
   region: Region;
   baseUrl: string;
-  oauthApiHost: string;
+  oauthApiHost?: string;
   output: 'text' | 'json';
   timeout: number;
   defaultTextModel?: string;