Merge pull request #139 from MiniMax-AI/feat/oauth-device-flow

feat(auth): add OAuth device-code login (Global / CN) into config.json

Author: kapelame

README.md

@@ -45,7 +45,10 @@ npm install -g mmx-cli
 ## Quick Start
 
 ```bash
-# Authenticate
+# Authenticate (interactive — choose MiniMax OAuth or paste an API key)
+mmx auth login
+
+# Or non-interactive
 mmx auth login --api-key sk-xxxxx
 
 # Start creating
@@ -130,16 +133,21 @@ mmx search query --q "latest news" --output json
 ### `mmx auth`
 
 ```bash
-mmx auth login --api-key sk-xxxxx
-mmx auth login                    # OAuth browser flow
+mmx auth login                              # interactive: pick OAuth (Global / China) or paste an API key
+mmx auth login --api-key sk-xxxxx           # save an API key directly
+mmx auth login --recommend                  # skip the menu, pick OAuth region interactively
+mmx auth login --recommend --region=global  # OAuth → api.minimax.io
+mmx auth login --recommend --region=cn      # OAuth → api.minimaxi.com
 mmx auth status
 mmx auth refresh
 mmx auth logout
 ```
 
 `mmx auth status` is the canonical way to verify active authentication.
-`~/.mmx/credentials.json` exists only for OAuth login. API-key login persists to
-`~/.mmx/config.json` (and `--api-key` can also be passed per command).
+Both OAuth and API-key credentials live in `~/.mmx/config.json` (the two are
+mutually exclusive — logging in with one method clears the other). API keys
+can also be passed per command via `--api-key`. With an API key, the region
+is auto-detected by probing both Global and CN.
 
 ### `mmx config` · `mmx quota`
 

README_CN.md

@@ -45,7 +45,10 @@ npm install -g mmx-cli
 ## 快速开始
 
 ```bash
-# 认证
+# 认证（交互式 — 选 MiniMax OAuth 或粘 API Key）
+mmx auth login
+
+# 或者非交互
 mmx auth login --api-key sk-xxxxx
 
 # 开始创作
@@ -130,16 +133,20 @@ mmx search query --q "最新动态" --output json
 ### `mmx auth`
 
 ```bash
-mmx auth login --api-key sk-xxxxx
-mmx auth login                    # OAuth 浏览器授权
+mmx auth login                              # 交互式：选 OAuth (Global / 中国) 或粘 API Key
+mmx auth login --api-key sk-xxxxx           # 直接保存 API Key
+mmx auth login --recommend                  # 跳过 3 选 1 菜单，弹出 region 选择器
+mmx auth login --recommend --region=global  # 直接 OAuth → api.minimax.io
+mmx auth login --recommend --region=cn      # 直接 OAuth → api.minimaxi.com
 mmx auth status
 mmx auth refresh
 mmx auth logout
 ```
 
-请使用 `mmx auth status` 作为认证状态的权威检查方式。`~/.mmx/credentials.json`
-只在 OAuth 登录时存在；API Key 登录会写入 `~/.mmx/config.json`（也可每次通过
-`--api-key` 直接传入）。
+请使用 `mmx auth status` 作为认证状态的权威检查方式。OAuth 与 API Key 凭据
+都保存在 `~/.mmx/config.json` 里，**两者互斥** —— 用一种登录会清掉另一种。
+也可以每次通过 `--api-key` 直接传入。使用 API Key 登录时，会自动同时探测
+Global 与中国两个 region，选用能通过的那个。
 
 ### `mmx config` · `mmx quota`
 

src/auth/credentials.ts

@@ -1,51 +1,26 @@
-import { readFileSync, writeFileSync, renameSync, unlinkSync, existsSync, statSync } from 'fs';
-import { getCredentialsPath, ensureConfigDir } from '../config/paths';
+import { readConfigFile, writeConfigFile } from '../config/loader';
 import type { CredentialFile } from './types';
 
-export async function loadCredentials(): Promise<CredentialFile | null> {
-  const path = getCredentialsPath();
-  if (!existsSync(path)) return null;
+/**
+ * OAuth credentials live inside the user's main config file
+ * (`~/.mmx/config.json`) under the `oauth` subobject. This keeps a
+ * single source of truth for all CLI state.
+ */
 
-  try {
-    checkPermissions(path);
-    const raw = readFileSync(path, 'utf-8');
-    const data = JSON.parse(raw) as CredentialFile;
-    if (!data.access_token || !data.refresh_token) return null;
-    return data;
-  } catch (err) {
-    const e = err as Error;
-    if (e instanceof SyntaxError || e.message.includes('JSON')) {
-      process.stderr.write(`Warning: credentials file is corrupted. Run 'mmx auth logout' to reset.\n`);
-    }
-    return null;
-  }
+export async function loadCredentials(): Promise<CredentialFile | null> {
+  const cfg = readConfigFile();
+  return cfg.oauth ?? null;
 }
 
 export async function saveCredentials(creds: CredentialFile): Promise<void> {
-  await ensureConfigDir();
-  const path = getCredentialsPath();
-  const tmp = path + '.tmp';
-  writeFileSync(tmp, JSON.stringify(creds, null, 2) + '\n', { mode: 0o600 });
-  renameSync(tmp, path);
+  const existing = readConfigFile() as Record<string, unknown>;
+  existing.oauth = creds;
+  await writeConfigFile(existing);
 }
 
 export async function clearCredentials(): Promise<void> {
-  const path = getCredentialsPath();
-  if (existsSync(path)) {
-    unlinkSync(path);
-  }
-}
-
-function checkPermissions(path: string): void {
-  try {
-    const stat = statSync(path);
-    const mode = stat.mode & 0o777;
-    if (mode !== 0o600) {
-      process.stderr.write(
-        `Warning: ${path} has permissions ${mode.toString(8)}, expected 600.\n`,
-      );
-    }
-  } catch {
-    // Ignore permission check errors on platforms that don't support it
-  }
+  const existing = readConfigFile() as Record<string, unknown>;
+  if (!('oauth' in existing)) return;
+  delete existing.oauth;
+  await writeConfigFile(existing);
 }