Merge branch 'main' into fix/image-download-https

Resolve conflict in src/commands/image/generate.ts: keep both the
base64 response format support (PR #94) and the file overwrite
warning (main).

Author: RyanLee-Dev

README.md

@@ -12,7 +12,7 @@
 </p>
 
 <p align="center">
-  <a href="README_CN.md">中文文档</a> · <a href="https://platform.minimax.io">Global Platform</a> · <a href="https://platform.minimaxi.com">CN Platform</a>
+  <a href="README_CN.md">中文文档</a> · <a href="https://platform.minimax.io">Global Platform</a> · <a href="https://platform.minimaxi.com">CN Platform</a> · <a href="https://platform.minimax.io/docs/token-plan/minimax-cli">Example</a>
 </p>
 
 ## Features

README_CN.md

@@ -12,7 +12,7 @@
 </p>
 
 <p align="center">
-  <a href="README.md">English</a> · <a href="https://platform.minimax.io">国际版平台</a> · <a href="https://platform.minimaxi.com">国内版平台</a>
+  <a href="README.md">English</a> · <a href="https://platform.minimax.io">国际版平台</a> · <a href="https://platform.minimaxi.com">国内版平台</a> · <a href="https://platform.minimaxi.com/docs/token-plan/minimax-cli">例子</a>
 </p>
 
 ## 功能特性

package.json

@@ -1,6 +1,6 @@
 {
   "name": "mmx-cli",
-  "version": "1.0.7",
+  "version": "1.0.11",
   "description": "CLI for the MiniMax AI Platform",
   "type": "module",
   "engines": {

skill/SKILL.md

@@ -178,7 +178,7 @@ mmx speech synthesize --text <text> [flags]
 | `--bitrate <bps>` | number | Bitrate (default: 128000) |
 | `--channels <n>` | number | Audio channels (default: 1) |
 | `--language <code>` | string | Language boost |
-| `--subtitles` | boolean | Include subtitle timing data |
+| `--subtitles` | boolean | Download and save subtitles as `.srt` file (alongside `--out` audio file). API must support subtitles for the selected model.
 | `--pronunciation <from/to>` | string, repeatable | Custom pronunciation |
 | `--sound-effect <effect>` | string | Add sound effect |
 | `--out <path>` | string | Save audio to file |
@@ -188,6 +188,9 @@ mmx speech synthesize --text <text> [flags]
 mmx speech synthesize --text "Hello world" --out hello.mp3 --quiet
 # stdout: hello.mp3
 
+mmx speech synthesize --text "Hello" --subtitles --out hello.mp3
+# saves hello.mp3 + hello.srt (SRT subtitle file)
+
 echo "Breaking news." | mmx speech synthesize --text-file - --out news.mp3
 ```
 

src/auth/oauth.ts

@@ -44,13 +44,21 @@ export async function startBrowserFlow(
 
   const authUrl = `${config.authorizationUrl}?${params}`;
 
-  // Open browser
-  const { exec } = await import('child_process');
+  // Open browser using execFile/spawn instead of exec to prevent shell injection.
+  // exec() passes the string to a shell, so a crafted authUrl containing shell
+  // metacharacters (e.g. from a malicious authorization server redirect) could
+  // execute arbitrary commands. execFile/spawn bypass the shell entirely. (#79)
+  const { execFile, spawn } = await import('child_process');
   const platform = process.platform;
-  const openCmd = platform === 'darwin' ? 'open' :
-    platform === 'win32' ? 'start' : 'xdg-open';
 
-  exec(`${openCmd} "${authUrl}"`);
+  if (platform === 'darwin') {
+    execFile('open', [authUrl]);
+  } else if (platform === 'win32') {
+    // On Windows, 'start' is a shell built-in — use cmd.exe /c start explicitly.
+    spawn('cmd.exe', ['/c', 'start', '', authUrl], { shell: false, detached: true });
+  } else {
+    execFile('xdg-open', [authUrl]);
+  }
   process.stderr.write('Opening browser to authenticate with MiniMax...\n');
 
   // Start local server to receive callback

src/auth/refresh.ts

@@ -6,45 +6,68 @@ import { ExitCode } from "../errors/codes";
 // OAuth config — endpoints TBD pending MiniMax OAuth documentation
 const TOKEN_URL = "https://api.minimax.io/v1/oauth/token";
 
+const MAX_REFRESH_RETRIES = 2;
+const RETRY_DELAY_MS = 500;
+
 export async function refreshAccessToken(
   refreshToken: string,
 ): Promise<OAuthTokens> {
-  let res: Response;
-  try {
-    res = await fetch(TOKEN_URL, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "refresh_token",
-        refresh_token: refreshToken,
-      }),
-      signal: AbortSignal.timeout(10_000),
-    });
-  } catch (err) {
-    const isTimeout =
-      err instanceof Error &&
-      (err.name === "AbortError" ||
-        err.name === "TimeoutError" ||
-        err.message.includes("timed out"));
-    throw new CLIError(
-      isTimeout
-        ? "Token refresh timed out — auth server did not respond within 10 s."
-        : `Token refresh failed: ${err instanceof Error ? err.message : String(err)}`,
-      ExitCode.AUTH,
-      "Check your network connection.\nRe-authenticate: mmx auth login",
-    );
-  }
+  let lastErr: Error | null = null;
+
+  for (let attempt = 0; attempt <= MAX_REFRESH_RETRIES; attempt++) {
+    if (attempt > 0) {
+      // Exponential backoff before retry
+      await new Promise(r => setTimeout(r, RETRY_DELAY_MS * attempt));
+    }
+
+    let res: Response;
+    try {
+      res = await fetch(TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: refreshToken,
+        }),
+        signal: AbortSignal.timeout(10_000),
+      });
+    } catch (err) {
+      const isTimeout =
+        err instanceof Error &&
+        (err.name === "AbortError" ||
+          err.name === "TimeoutError" ||
+          err.message.includes("timed out"));
+      lastErr = new Error(
+        isTimeout
+          ? "Token refresh timed out — auth server did not respond within 10 s."
+          : `Token refresh failed: ${err instanceof Error ? err.message : String(err)}`,
+      );
+      continue; // retry
+    }
+
+    if (!res.ok) {
+      // 4xx errors won't recover with retry
+      if (res.status >= 400 && res.status < 500) {
+        throw new CLIError(
+          "OAuth session expired and could not be refreshed.",
+          ExitCode.AUTH,
+          "Re-authenticate: mmx auth login",
+        );
+      }
+      lastErr = new Error(`Token refresh failed: HTTP ${res.status}`);
+      continue; // retry 5xx errors
+    }
 
-  if (!res.ok) {
-    throw new CLIError(
-      "OAuth session expired and could not be refreshed.",
-      ExitCode.AUTH,
-      "Re-authenticate: mmx auth login",
-    );
+    const data = (await res.json()) as OAuthTokens;
+    return data;
   }
 
-  const data = (await res.json()) as OAuthTokens;
-  return data;
+  // All retries exhausted
+  throw new CLIError(
+    `Token refresh failed after ${MAX_REFRESH_RETRIES + 1} attempts: ${lastErr?.message}`,
+    ExitCode.AUTH,
+    "Check your network connection.\nRe-authenticate: mmx auth login",
+  );
 }
 
 export async function ensureFreshToken(creds: CredentialFile): Promise<string> {

src/client/endpoints.ts

@@ -41,7 +41,7 @@ export function vlmEndpoint(baseUrl: string): string {
 export function quotaEndpoint(baseUrl: string): string {
   // Quota endpoint uses api subdomain
   const host = baseUrl.includes('minimaxi.com') ? 'https://api.minimaxi.com' : 'https://api.minimax.io';
-  return `${host}/v1/api/openplatform/coding_plan/remains`;
+  return `${host}/v1/token_plan/remains`;
 }
 
 export function fileUploadEndpoint(baseUrl: string): string {

src/commands/config/set.ts

@@ -30,8 +30,9 @@ export default defineCommand({
     'mmx config set --key base_url --value https://api-uw.minimax.io',
   ],
   async run(config: Config, flags: GlobalFlags) {
-    const key = flags.key as string | undefined;
-    const value = flags.value as string | undefined;
+    const positional = flags._positional as string[] | undefined;
+    const key = (flags.key as string | undefined) ?? positional?.[0];
+    const value = (flags.value as string | undefined) ?? positional?.[1];
 
     if (!key || value === undefined) {
       throw new CLIError(
@@ -85,6 +86,12 @@ export default defineCommand({
 
     const existing = readConfigFile() as Record<string, unknown>;
     existing[resolvedKey] = resolvedKey === 'timeout' ? Number(value) : value;
+
+    // When API key changes, clear cached region so it gets re-detected
+    if (resolvedKey === 'api_key') {
+      delete existing.region;
+    }
+
     await writeConfigFile(existing);
 
     if (!config.quiet) {

src/commands/image/generate.ts

@@ -164,6 +164,9 @@ export default defineCommand({
       for (let i = 0; i < images.length; i++) {
         const filename = `${prefix}_${String(i + 1).padStart(3, '0')}.jpg`;
         const destPath = join(outDir, filename);
+        if (existsSync(destPath)) {
+          process.stderr.write(`Warning: overwriting existing file: ${destPath}\n`);
+        }
         writeFileSync(destPath, images[i]!, 'base64');
         saved.push(destPath);
       }
@@ -172,12 +175,24 @@ export default defineCommand({
       for (let i = 0; i < imageUrls.length; i++) {
         const filename = `${prefix}_${String(i + 1).padStart(3, '0')}.jpg`;
         const destPath = join(outDir, filename);
+        if (existsSync(destPath)) {
+          process.stderr.write(`Warning: overwriting existing file: ${destPath}\n`);
+        }
         await downloadFile(imageUrls[i]!, destPath, { quiet: config.quiet });
         saved.push(destPath);
       }
     }
 
-    if (config.quiet) {
+    // --output json is respected even in --quiet mode (JSON is the actual output, not progress)
+    if (format === 'json') {
+      console.log(formatOutput({
+        id: response.data.task_id,
+        saved,
+        success_count: response.data.success_count,
+        failed_count: response.data.failed_count,
+      }, format));
+    } else if (config.quiet) {
+      // Non-JSON quiet mode: just print file paths
       console.log(saved.join('\n'));
     } else {
       console.log(formatOutput({

src/commands/search/query.ts

@@ -30,7 +30,7 @@ export default defineCommand({
     'mmx search query --q "latest news" --output json',
   ],
   async run(config: Config, flags: GlobalFlags) {
-    const query = (flags.q ?? (flags._positional as string[]|undefined)?.[0]) as string | undefined;
+    const query = (flags.q ?? flags.query ?? (flags._positional as string[]|undefined)?.[0]) as string | undefined;
 
     if (!query) {
       throw new CLIError(