refactor: api key from file only, interactive setup, dedup utilities

Auth:
- Remove env var fallback from resolver; file is sole persistent source
- Add ensureApiKey() interactive setup: file → env confirm → prompt input
- Add maskToken() utility, replacing 5 divergent inline implementations
- Show config file path and key/region source in status bar

Dedup:
- Extract renderQuotaTable() shared by quota show and auth status
- Extract saveAudioOutput() shared by speech/synthesize and music/generate
- Extract readTextFromPathOrStdin() shared by speech and music
- auth status now uses the same rich quota table as quota show

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: RyanLee-Dev

src/auth/resolver.ts

@@ -23,14 +23,9 @@ export async function resolveCredential(config: Config): Promise<ResolvedCredent
     return { token: config.fileApiKey, method: 'api-key', source: 'config.json' };
   }
 
-  // 4. Environment variable
-  if (config.envApiKey) {
-    return { token: config.envApiKey, method: 'api-key', source: 'env' };
-  }
-
   throw new CLIError(
     'No credentials found.',
     ExitCode.AUTH,
-    'Log in:              minimax auth login\nSet env var:         export MINIMAX_API_KEY=sk-xxxxx\nPass directly:       --api-key sk-xxxxx',
+    'Log in:        minimax auth login\nPass directly:  --api-key sk-xxxxx',
   );
 }

src/auth/setup.ts

@@ -0,0 +1,45 @@
+import type { Config } from '../config/schema';
+import { readConfigFile, writeConfigFile } from '../config/loader';
+import { promptText, promptConfirm } from '../utils/prompt';
+import { isInteractive } from '../utils/env';
+import { maskToken } from '../utils/token';
+import { CLIError } from '../errors/base';
+import { ExitCode } from '../errors/codes';
+
+export async function ensureApiKey(config: Config): Promise<void> {
+  if (config.apiKey || config.fileApiKey) return;
+
+  const envKey = process.env.MINIMAX_API_KEY;
+  let key: string | undefined;
+
+  if (envKey) {
+    if (!isInteractive({ nonInteractive: config.nonInteractive })) {
+      key = envKey;
+    } else {
+      const use = await promptConfirm({
+        message: `Found MINIMAX_API_KEY in environment (${maskToken(envKey)}). Save it to config file?`,
+      });
+      if (use) key = envKey;
+    }
+  }
+
+  if (!key) {
+    if (!isInteractive({ nonInteractive: config.nonInteractive })) {
+      throw new CLIError(
+        'No API key found.',
+        ExitCode.AUTH,
+        'Set env var:    export MINIMAX_API_KEY=sk-xxxxx\nPass directly:  --api-key sk-xxxxx',
+      );
+    }
+    const input = await promptText({ message: 'Enter your MiniMax API key:' });
+    if (!input) throw new CLIError('API key is required.', ExitCode.AUTH);
+    key = input;
+  }
+
+  const data = { ...(readConfigFile() as Record<string, unknown>), api_key: key };
+  await writeConfigFile(data);
+  config.fileApiKey = key;
+
+  const path = config.configPath ?? '~/.minimax/config.json';
+  process.stderr.write(`API key saved to ${path}\n`);
+}

src/commands/auth/login.ts

@@ -9,6 +9,7 @@ import { quotaEndpoint } from '../../client/endpoints';
 import { getConfigPath } from '../../config/paths';
 import { readConfigFile, writeConfigFile } from '../../config/loader';
 import { isInteractive } from '../../utils/env';
+import { maskToken } from '../../utils/token';
 import type { Config } from '../../config/schema';
 import type { GlobalFlags } from '../../types/flags';
 import type { CredentialFile } from '../../auth/types';
@@ -32,7 +33,7 @@ export default defineCommand({
   async run(config: Config, flags: GlobalFlags) {
     const envKey = process.env.MINIMAX_API_KEY;
     if (envKey) {
-      const maskedEnvKey = envKey.length > 8 ? `${envKey.slice(0, 4)}...${envKey.slice(-4)}` : '***';
+      const maskedEnvKey = maskToken(envKey);
       if (isInteractive({ nonInteractive: config.nonInteractive })) {
         const { confirm } = await import('@clack/prompts');
         const proceed = await confirm({

src/commands/auth/status.ts

@@ -4,6 +4,8 @@ import { loadCredentials } from '../../auth/credentials';
 import { formatOutput, detectOutputFormat } from '../../output/formatter';
 import { requestJson } from '../../client/http';
 import { quotaEndpoint } from '../../client/endpoints';
+import { renderQuotaTable } from '../../output/quota-table';
+import { maskToken } from '../../utils/token';
 import type { Config } from '../../config/schema';
 import type { GlobalFlags } from '../../types/flags';
 import type { QuotaResponse } from '../../types/api';
@@ -33,7 +35,7 @@ export default defineCommand({
             if (creds.account) result.account = creds.account;
           }
         } else {
-          result.key = credential.token.slice(0, 6) + '...' + credential.token.slice(-4);
+          result.key = maskToken(credential.token);
         }
         console.log(formatOutput(result, format));
         return;
@@ -45,8 +47,7 @@ export default defineCommand({
       console.log(`  Source: ${credential.source}`);
 
       const token = credential.token;
-      const maskedToken = token.length > 8 ? `${token.slice(0, 4)}...${token.slice(-4)}` : '***';
-      console.log(`  Key:    ${maskedToken}`);
+      console.log(`  Key:    ${maskToken(token)}`);
 
       if (credential.method === 'oauth') {
         const creds = await loadCredentials();
@@ -59,32 +60,14 @@ export default defineCommand({
       }
 
       // Fetch quota snapshot
-      console.log('');
       process.stderr.write('Fetching quota snapshot...\n');
       try {
         const url = quotaEndpoint(config.baseUrl);
         const quota = await requestJson<QuotaResponse>(config, { url, method: 'GET' });
-        const models = quota.model_remains || [];
-        if (models.length > 0) {
-          console.log('Available Quotas:');
-          for (const m of models.slice(0, 5)) {
-            const remaining = m.current_interval_total_count - m.current_interval_usage_count;
-            const pct = m.current_interval_total_count > 0
-              ? Math.round((remaining / m.current_interval_total_count) * 100)
-              : 0;
-            console.log(`  ${m.model_name.padEnd(24)} ${String(remaining).padStart(6)} / ${m.current_interval_total_count}  (${pct}%)`);
-          }
-          if (models.length > 5) {
-            console.log(`  ... and ${models.length - 5} more (run 'minimax quota show' for full details)`);
-          }
-        } else {
-          console.log('  No quota data available.');
-        }
+        renderQuotaTable(quota.model_remains || [], config);
       } catch (e) {
         console.log(`  Quota fetch failed: ${(e as Error).message}`);
       }
-      console.log('');
-      console.log("Run 'minimax quota show' for full details.");
 
     } catch {
       const format = detectOutputFormat(config.output);

src/commands/config/show.ts

@@ -2,6 +2,7 @@ import { defineCommand } from '../../command';
 import { readConfigFile as loadConfigFile } from '../../config/loader';
 import { getConfigPath } from '../../config/paths';
 import { formatOutput, detectOutputFormat } from '../../output/formatter';
+import { maskToken } from '../../utils/token';
 import type { Config } from '../../config/schema';
 import type { GlobalFlags } from '../../types/flags';
 
@@ -27,7 +28,7 @@ export default defineCommand({
 
     // Mask API key if present
     if (file.api_key) {
-      result.api_key = file.api_key.slice(0, 6) + '...' + file.api_key.slice(-4);
+      result.api_key = maskToken(file.api_key);
     }
 
     console.log(formatOutput(result, format));

src/commands/music/generate.ts

@@ -4,10 +4,11 @@ import { ExitCode } from '../../errors/codes';
 import { request, requestJson } from '../../client/http';
 import { musicEndpoint } from '../../client/endpoints';
 import { formatOutput, detectOutputFormat } from '../../output/formatter';
+import { saveAudioOutput } from '../../output/audio';
+import { readTextFromPathOrStdin } from '../../utils/fs';
 import type { Config } from '../../config/schema';
 import type { GlobalFlags } from '../../types/flags';
 import type { MusicRequest, MusicResponse } from '../../types/api';
-import { readFileSync, writeFileSync } from 'fs';
 
 export default defineCommand({
   name: 'music generate',
@@ -33,10 +34,7 @@ export default defineCommand({
     let lyrics = flags.lyrics as string | undefined;
 
     if (flags.lyricsFile) {
-      const path = flags.lyricsFile as string;
-      lyrics = path === '-'
-        ? readFileSync('/dev/stdin', 'utf-8')
-        : readFileSync(path, 'utf-8');
+      lyrics = readTextFromPathOrStdin(flags.lyricsFile as string);
     }
 
     if (!prompt && !lyrics) {
@@ -94,35 +92,7 @@ export default defineCommand({
       body,
     });
 
-    if (!config.quiet) {
-      process.stderr.write('[Model: music-2.5]\n');
-    }
-
-    if (outPath) {
-      const audioBuffer = Buffer.from(response.data.audio!, 'hex');
-      writeFileSync(outPath, audioBuffer);
-
-      if (config.quiet) {
-        console.log(outPath);
-      } else {
-        console.log(formatOutput({
-          saved: outPath,
-          duration_ms: response.extra_info?.audio_length,
-          size_bytes: response.extra_info?.audio_size,
-          sample_rate: response.extra_info?.audio_sample_rate,
-        }, format));
-      }
-    } else {
-      const audioUrl = response.data.audio_url ?? response.data.audio;
-      if (config.quiet) {
-        console.log(audioUrl);
-      } else {
-        console.log(formatOutput({
-          url: audioUrl,
-          duration_ms: response.extra_info?.audio_length,
-          size_bytes: response.extra_info?.audio_size,
-        }, format));
-      }
-    }
+    if (!config.quiet) process.stderr.write('[Model: music-2.5]\n');
+    saveAudioOutput(response, outPath, format, config.quiet);
   },
 });