feat(auth): mentor feedback round — endpoint URLs, mutex, --recommend, region detection

- Menu labels show the API endpoint:
    MiniMax (OAuth login → api.minimax.io)
    MiniMax (OAuth login → api.minimaxi.com)
    API key
- config.json now stores oauth XOR api_key:
    OAuth login clears any existing api_key
    API-key login clears any existing oauth subobject
- Status bar shows the API URL instead of the region label:
    MINIMAX ~/.mmx/config.json | URL: api.minimaxi.com | Key: oat-...vBBY
- API-key login auto-detects the region by probing both Global and CN
  (uses existing detectRegion helper); detected region is persisted.
- New --recommend flag jumps straight to OAuth, skipping the 3-option
  menu. Combine with --region=global|cn to skip the region picker too:
    mmx auth login --recommend
    mmx auth login --recommend --region=global
    mmx auth login --recommend --region=cn

Author: kapelame

src/auth/setup.ts

@@ -1,24 +1,29 @@
 import type { Config, Region } from '../config/schema';
+import { REGIONS } from '../config/schema';
 import { readConfigFile, writeConfigFile } from '../config/loader';
 import { promptText, promptConfirm } from '../utils/prompt';
 import { isInteractive } from '../utils/env';
 import { maskToken } from '../utils/token';
 import { CLIError } from '../errors/base';
 import { ExitCode } from '../errors/codes';
 import { deviceCodeLogin } from './oauth';
-import { saveCredentials, loadCredentials } from './credentials';
+import { loadCredentials } from './credentials';
 
 interface AuthChoice {
   value: 'oauth-global' | 'oauth-cn' | 'api-key';
   label: string;
 }
 
 const AUTH_CHOICES: AuthChoice[] = [
-  { value: 'oauth-global', label: 'MiniMax (OAuth login, Global)' },
-  { value: 'oauth-cn',     label: 'MiniMax (OAuth login, China)' },
+  { value: 'oauth-global', label: `MiniMax (OAuth login → ${stripScheme(REGIONS.global)})` },
+  { value: 'oauth-cn',     label: `MiniMax (OAuth login → ${stripScheme(REGIONS.cn)})` },
   { value: 'api-key',      label: 'API key' },
 ];
 
+function stripScheme(url: string): string {
+  return url.replace(/^https?:\/\//, '');
+}
+
 export async function ensureAuth(config: Config): Promise<void> {
   if (config.apiKey || config.fileApiKey) return;
   if (await loadCredentials()) return;
@@ -66,9 +71,31 @@ export async function pickAuthMethod(): Promise<AuthChoice['value']> {
   return value as AuthChoice['value'];
 }
 
+/**
+ * Region-only picker used by `mmx auth login --recommend` (no API-key option).
+ */
+export async function pickOAuthRegion(): Promise<Region> {
+  const { select, isCancel } = await import('@clack/prompts');
+  const value = await select({
+    message: 'Select an OAuth region:',
+    options: [
+      { value: 'global', label: `Global  →  ${stripScheme(REGIONS.global)}` },
+      { value: 'cn',     label: `China   →  ${stripScheme(REGIONS.cn)}` },
+    ],
+  });
+  if (isCancel(value)) throw new CLIError('Authentication cancelled.', ExitCode.AUTH);
+  return value as Region;
+}
+
 export async function runOAuthLogin(region: Region): Promise<void> {
   const creds = await deviceCodeLogin(region);
-  await saveCredentials(creds);
+  // OAuth and api_key are mutually exclusive — drop any stale api_key
+  // so `mmx auth status` and the resolver see a single source of truth.
+  const existing = readConfigFile() as Record<string, unknown>;
+  delete existing.api_key;
+  existing.oauth = creds;
+  existing.region = region;
+  await writeConfigFile(existing);
   process.stderr.write('Logged in successfully.\n');
   process.stderr.write('Credentials saved to ~/.mmx/config.json\n');
 }

src/commands/auth/login.ts

@@ -1,10 +1,11 @@
 import { defineCommand } from '../../command';
 import { CLIError } from '../../errors/base';
 import { ExitCode } from '../../errors/codes';
-import { pickAuthMethod, runOAuthLogin } from '../../auth/setup';
+import { pickAuthMethod, pickOAuthRegion, runOAuthLogin } from '../../auth/setup';
 import { requestJson } from '../../client/http';
 import { quotaEndpoint } from '../../client/endpoints';
 import { renderQuotaTable } from '../../output/quota-table';
+import { detectRegion } from '../../config/detect-region';
 
 import { getConfigPath } from '../../config/paths';
 import { readConfigFile, writeConfigFile } from '../../config/loader';
@@ -13,7 +14,7 @@ import { maskToken } from '../../utils/token';
 import type { Config, Region } from '../../config/schema';
 import { REGIONS } from '../../config/schema';
 import type { GlobalFlags } from '../../types/flags';
-import type { QuotaResponse, QuotaModelRemain } from '../../types/api';
+import type { QuotaModelRemain } from '../../types/api';
 
 interface QuotaApiResponse {
   model_remains: QuotaModelRemain[];
@@ -43,14 +44,17 @@ async function showDashboardAfterLogin(config: Config): Promise<void> {
 export default defineCommand({
   name: 'auth login',
   description: 'Authenticate via OAuth or API key',
-  usage: 'mmx auth login [--api-key <key>] [--region global|cn]',
+  usage: 'mmx auth login [--api-key <key>] [--recommend] [--region=global|cn]',
   options: [
     { flag: '--api-key <key>', description: 'Skip the menu and save this API key directly' },
+    { flag: '--recommend',     description: 'Skip the menu, go straight to OAuth (combine with --region= to skip the region picker)' },
   ],
   examples: [
     'mmx auth login',
     'mmx auth login --api-key sk-cp-xxxxx',
-    'mmx auth login --region cn',
+    'mmx auth login --recommend',
+    'mmx auth login --recommend --region=global',
+    'mmx auth login --recommend --region=cn',
   ],
   async run(config: Config, flags: GlobalFlags) {
     const envKey = process.env.MINIMAX_API_KEY;
@@ -89,6 +93,14 @@ export default defineCommand({
       );
     }
 
+    // --recommend: skip the 3-option menu, go straight to OAuth.
+    // With --region, skip the region picker too.
+    if (flags.recommend) {
+      const region = (flags.region as Region) || await pickOAuthRegion();
+      await completeOAuthLogin(config, region);
+      return;
+    }
+
     const choice = await pickAuthMethod();
     if (choice === 'api-key') {
       const { text, isCancel } = await import('@clack/prompts');
@@ -102,30 +114,38 @@ export default defineCommand({
     }
 
     const region: Region = (flags.region as Region) || (choice === 'oauth-cn' ? 'cn' : 'global');
-    await runOAuthLogin(region);
-
-    // Reload config so the OAuth subobject (and its resource_url) are picked up.
-    const fresh = readConfigFile();
-    const cfg: Config = {
-      ...config,
-      region,
-      baseUrl: fresh.oauth?.resource_url || REGIONS[region],
-    };
-    await showDashboardAfterLogin(cfg);
+    await completeOAuthLogin(config, region);
   },
 });
 
+async function completeOAuthLogin(config: Config, region: Region): Promise<void> {
+  await runOAuthLogin(region);
+
+  // Reload so the OAuth subobject (and any resource_url override) is picked up.
+  const fresh = readConfigFile();
+  const cfg: Config = {
+    ...config,
+    region,
+    baseUrl: fresh.oauth?.resource_url || REGIONS[region],
+  };
+  await showDashboardAfterLogin(cfg);
+}
+
 async function loginWithApiKey(config: Config, key: string): Promise<void> {
   if (config.dryRun) {
     console.log('Would validate and save API key.');
     return;
   }
 
-  process.stderr.write('Testing key... ');
+  // Probe both regions and pick the one the key actually authenticates against.
+  // This doubles as key validation — if neither region accepts it, the key is bad.
+  const detected = await detectRegion(key);
+  const cfg: Config = { ...config, region: detected, baseUrl: REGIONS[detected], apiKey: key };
+
+  // Verify the detection actually authorizes the quota endpoint (defends against
+  // detectRegion's graceful 'global' fallback when the network is unreachable).
   try {
-    const test = { ...config, apiKey: key };
-    await requestJson<QuotaResponse>(test, { url: quotaEndpoint(test.baseUrl) });
-    process.stderr.write('Valid\n');
+    await requestJson<QuotaApiResponse>(cfg, { url: quotaEndpoint(cfg.baseUrl) });
   } catch {
     throw new CLIError(
       'API key validation failed.',
@@ -134,10 +154,13 @@ async function loginWithApiKey(config: Config, key: string): Promise<void> {
     );
   }
 
+  // OAuth and api_key are mutually exclusive — drop any stale oauth block.
   const existing = readConfigFile() as Record<string, unknown>;
+  delete existing.oauth;
   existing.api_key = key;
+  existing.region = detected;
   await writeConfigFile(existing);
   process.stderr.write(`API key saved to ${getConfigPath()}\n`);
 
-  await showDashboardAfterLogin({ ...config, apiKey: key });
+  await showDashboardAfterLogin(cfg);
 }

src/output/status-bar.ts

@@ -20,12 +20,16 @@ function tildePath(p: string): string {
   return p.startsWith(homedir()) ? p.replace(homedir(), '~') : p;
 }
 
+function stripScheme(url: string): string {
+  return url.replace(/^https?:\/\//, '');
+}
+
 export function maybeShowStatusBar(config: Config, token: string, model?: string): void {
   if (config.quiet || printed || !process.stderr.isTTY) return;
   printed = true;
 
   const filePath   = config.configPath ? tildePath(config.configPath) : '~/.mmx/config.json';
-  const regionSrc  = config.fileRegion ? `${config.fileRegion} (file)` : 'global (default)';
+  const baseUrlStr = stripScheme(config.baseUrl);
   const keySrc     = config.apiKey ? '(flag)' : '(file)';
   const maskedKey  = maskToken(token);
   const modelStr   = model ? ` ${dim}|${reset} ${dim}Model:${reset} ${mmPurple}${model}${reset}` : '';
@@ -34,7 +38,7 @@ export function maybeShowStatusBar(config: Config, token: string, model?: string
     `${bold}${mmBlue}MINIMAX${reset} ` +
     `${dim}${filePath}${reset} ` +
     `${dim}|${reset} ` +
-    `${dim}Region:${reset} ${mmCyan}${regionSrc}${reset} ` +
+    `${dim}URL:${reset} ${mmCyan}${baseUrlStr}${reset} ` +
     `${dim}|${reset} ` +
     `${dim}Key:${reset} ${mmPink}${maskedKey}${reset} ${dim}${keySrc}${reset}` +
     `${modelStr}\n`,