fix: fail closed when region detection is inconclusive

Author: NianJiuZst

src/commands/auth/login.ts

@@ -76,7 +76,7 @@ export default defineCommand({
     }
 
     if (flags.apiKey) {
-      await loginWithApiKey(config, flags.apiKey as string);
+      await loginWithApiKey(config, flags.apiKey as string, flags.region as Region | undefined);
       return;
     }
 
@@ -109,7 +109,7 @@ export default defineCommand({
         validate: (v) => (v && v.length > 0 ? undefined : 'API key cannot be empty.'),
       });
       if (isCancel(key)) throw new CLIError('Authentication cancelled.', ExitCode.AUTH);
-      await loginWithApiKey(config, key as string);
+      await loginWithApiKey(config, key as string, flags.region as Region | undefined);
       return;
     }
 
@@ -131,19 +131,22 @@ async function completeOAuthLogin(config: Config, region: Region): Promise<void>
   await showDashboardAfterLogin(cfg);
 }
 
-async function loginWithApiKey(config: Config, key: string): Promise<void> {
+async function loginWithApiKey(
+  config: Config,
+  key: string,
+  explicitRegion?: Region,
+): Promise<void> {
   if (config.dryRun) {
     console.log('Would validate and save API key.');
     return;
   }
 
-  // Probe both regions and pick the one the key actually authenticates against.
-  // This doubles as key validation — if neither region accepts it, the key is bad.
-  const detected = await detectRegion(key);
+  // An explicit region is authoritative. Otherwise probe both regions and fail
+  // closed if neither can be confirmed; never persist a guessed fallback.
+  const detected = explicitRegion ?? await detectRegion(key);
   const cfg: Config = { ...config, region: detected, baseUrl: REGIONS[detected], apiKey: key };
 
-  // Verify the detection actually authorizes the quota endpoint (defends against
-  // detectRegion's graceful 'global' fallback when the network is unreachable).
+  // Verify the selected region actually authorizes the quota endpoint.
   try {
     await requestJson<QuotaApiResponse>(cfg, { url: quotaEndpoint(cfg.baseUrl) });
   } catch {

src/config/detect-region.ts

@@ -1,5 +1,7 @@
 import { REGIONS, type Region } from "./schema";
 import { readConfigFile, writeConfigFile } from "./loader";
+import { CLIError } from "../errors/base";
+import { ExitCode } from "../errors/codes";
 
 const QUOTA_PATH = "/v1/token_plan/remains";
 
@@ -51,13 +53,11 @@ export async function detectRegion(apiKey: string): Promise<Region> {
   const match = results.find((r) => r.ok);
   if (!match) {
     process.stderr.write(" failed\n");
-    process.stderr.write(
-      `Warning: API key failed validation against all regions (global, cn).\n` +
-      `  This usually means the API key is invalid or the network is blocking requests.\n` +
-      `  Falling back to 'global'. Subsequent requests may fail.\n` +
-      `  Run 'mmx auth status' to verify your credentials.\n`,
+    throw new CLIError(
+      "Could not determine the API key region.",
+      ExitCode.AUTH,
+      "No region was changed. Check the key and network, then retry or pass --region global|cn explicitly.",
     );
-    return "global";
   }
   const detected: Region = match.region;
   process.stderr.write(` ${detected}\n`);

test/auth/timeout-fix.test.ts

@@ -77,7 +77,7 @@ describe('detect-region: probeRegion auth style fallback', () => {
     }
   });
 
-  it('falls back to global when key is invalid for all auth styles and regions', async () => {
+  it('fails closed when key is invalid for all auth styles and regions', async () => {
     server = createMockServer({
       routes: {
         '/v1/token_plan/remains': () =>
@@ -93,8 +93,14 @@ describe('detect-region: probeRegion auth style fallback', () => {
 
     try {
       const { detectRegion } = await import('../../src/config/detect-region');
-      const region = await detectRegion('bad-key');
-      expect(region).toBe('global'); // graceful fallback
+      try {
+        await detectRegion('bad-key');
+        throw new Error('Expected region detection to fail');
+      } catch (error) {
+        expect(error).toBeInstanceOf(CLIError);
+        expect((error as CLIError).message).toBe('Could not determine the API key region.');
+        expect((error as CLIError).exitCode).toBe(ExitCode.AUTH);
+      }
     } finally {
       (REGIONS as Record<string, string>).global = origGlobal;
       (REGIONS as Record<string, string>).cn = origCn;

test/commands/auth/login.test.ts

@@ -1,7 +1,25 @@
-import { describe, it, expect } from 'bun:test';
+import { afterEach, describe, expect, it } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { default as loginCommand } from '../../../src/commands/auth/login';
+import { REGIONS } from '../../../src/config/schema';
+import { createMockServer, jsonResponse, type MockServer } from '../../helpers/mock-server';
 
 describe('auth login command', () => {
+  const originalConfigDir = process.env.MMX_CONFIG_DIR;
+  let server: MockServer | undefined;
+  let configDir: string | undefined;
+
+  afterEach(() => {
+    server?.close();
+    if (configDir) rmSync(configDir, { recursive: true, force: true });
+    if (originalConfigDir === undefined) delete process.env.MMX_CONFIG_DIR;
+    else process.env.MMX_CONFIG_DIR = originalConfigDir;
+    server = undefined;
+    configDir = undefined;
+  });
+
   it('has correct name and description', () => {
     expect(loginCommand.name).toBe('auth login');
     expect(loginCommand.description).toContain('Authenticate');
@@ -35,4 +53,62 @@ describe('auth login command', () => {
       }),
     ).rejects.toThrow('--api-key is required');
   });
+
+  it('honors an explicit region without running auto-detection', async () => {
+    let quotaRequests = 0;
+    server = createMockServer({
+      routes: {
+        '/v1/token_plan/remains': () => {
+          quotaRequests += 1;
+          return jsonResponse({
+            model_remains: [],
+            base_resp: { status_code: 0, status_msg: 'ok' },
+          });
+        },
+      },
+    });
+
+    configDir = mkdtempSync(join(tmpdir(), 'mmx-region-login-'));
+    process.env.MMX_CONFIG_DIR = configDir;
+
+    const originalGlobal = REGIONS.global;
+    const originalCn = REGIONS.cn;
+    (REGIONS as Record<string, string>).global = 'http://127.0.0.1:1';
+    (REGIONS as Record<string, string>).cn = server.url;
+
+    try {
+      await loginCommand.execute(
+        {
+          region: 'global',
+          baseUrl: originalGlobal,
+          output: 'text',
+          timeout: 1,
+          verbose: false,
+          quiet: true,
+          noColor: true,
+          yes: false,
+          dryRun: false,
+          nonInteractive: true,
+          async: false,
+        },
+        {
+          apiKey: 'cn-test-key',
+          region: 'cn',
+          quiet: true,
+          verbose: false,
+          noColor: true,
+          yes: false,
+          dryRun: false,
+          help: false,
+          nonInteractive: true,
+          async: false,
+        },
+      );
+
+      expect(quotaRequests).toBe(2);
+    } finally {
+      (REGIONS as Record<string, string>).global = originalGlobal;
+      (REGIONS as Record<string, string>).cn = originalCn;
+    }
+  });
 });