Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 21 additions & 6 deletions docs/reference/commands.md
Original file line number Diff line number Diff line change
Expand Up @@ -367,11 +367,11 @@ reports neutral account labels and does not expose raw account emails.

## Local bridge commands

The optional local bridge exposes only `/health`, `/v1/models`, and
`/v1/responses` on loopback. Forwarded bridge requests require a bearer token
by default. When a runtime client API key is configured for the bridge, inbound
auth must remain enabled (`requireAuth=true`); the bridge rewrites outbound
auth for the rotation proxy and strips inbound cookies / proxy-auth headers.
The optional local bridge exposes `/health`, `/v1/models`, and `/v1/responses`
on loopback. A MiniMax backend also exposes `/anthropic/v1/messages` and
`/anthropic/v1/messages/count_tokens`. Forwarded bridge requests require a
local client token by default. Clients can send it as a bearer token or
`x-api-key`; the bridge replaces inbound credentials before forwarding.

```bash
codex-multi-auth bridge token create [--label <label>] [--json]
Expand Down Expand Up @@ -411,6 +411,20 @@ console.log(bridge.baseUrl); // e.g. http://127.0.0.1:43123
// Clients: Authorization: Bearer <cma_local_...> from `bridge token create`
```

For direct MiniMax access, select a regional backend instead of a runtime
proxy. The provider key remains inside the host process, and local client auth
must stay enabled:

```ts
const bridge = await startLocalBridge({
miniMax: {
apiKey: process.env.MINIMAX_API_KEY!,
region: "global", // or "cn"
},
requireAuth: true,
});
```

Comment on lines +414 to +427

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

separate the runtime and direct minimax setup paths.

docs/reference/commands.md:414-425 introduces direct minimax configuration, but the following checklist at docs/reference/commands.md:430-433 still requires runtime rotation and a proxy. that misdirects direct minimax users. give each backend its own checklist. also replace process.env.MINIMAX_API_KEY! at docs/reference/commands.md:421 with an explicit missing-key check or a preceding export command.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reference/commands.md` around lines 414 - 427, Update the direct MiniMax
section around startLocalBridge to validate MINIMAX_API_KEY explicitly or show a
preceding export command instead of using a non-null assertion, and separate its
checklist from the runtime/proxy setup checklist. Keep runtime rotation and
proxy requirements only under the runtime backend path, while documenting the
direct regional backend requirements independently.

Source: Path instructions

Operator checklist:

1. Ensure runtime rotation is available (`codex-multi-auth rotation status` / a wrapper session that owns a proxy).
Expand All @@ -420,7 +434,8 @@ Operator checklist:
5. Generate glue with `codex-multi-auth integrations --kind python|curl|env|...`.

Security invariants match the library: loopback-only bind, loopback-only
`runtimeBaseUrl`, and `requireAuth=true` whenever a runtime client key is injected.
`runtimeBaseUrl`, and `requireAuth=true` whenever a runtime or MiniMax key is
injected.

---

Expand Down
8 changes: 5 additions & 3 deletions docs/reference/public-api.md
Original file line number Diff line number Diff line change
Expand Up @@ -126,9 +126,11 @@ These details are documented for operator expectations. Internal helper process
`startLocalBridge` (package root / public barrel) is the host API that opens the
optional loopback bridge. There is no `bridge start` CLI daemon.

- Bind host must be loopback; `runtimeBaseUrl` must also be loopback (the runtime rotation proxy).
- Default `requireAuth=true`. Configuring `runtimeClientApiKey` **requires** `requireAuth=true`.
- Surfaces: `/health`, `/v1/models`, `/v1/responses` only.
- Bind host must be loopback; runtime mode also requires a loopback `runtimeBaseUrl`.
- Default `requireAuth=true`. Configuring `runtimeClientApiKey` or `miniMax` **requires** `requireAuth=true`.
- Runtime surfaces: `/health`, `/v1/models`, and `/v1/responses`.
- MiniMax surfaces add `/anthropic/v1/messages` and `/anthropic/v1/messages/count_tokens` with Global or China endpoints.
- Inbound bearer and `x-api-key` credentials are local client tokens; backend credentials replace them before egress.
- Client tokens are managed with `codex-multi-auth bridge token ...` (hashes on disk).
- Client snippets: `codex-multi-auth integrations ...`.

Expand Down
3 changes: 3 additions & 0 deletions index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -4720,6 +4720,9 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
};
};

export * from "./lib/local-bridge.js";
export * from "./lib/providers/minimax.js";

export const OpenAIAuthPlugin = OpenAIOAuthPlugin;

export default OpenAIOAuthPlugin;
1 change: 1 addition & 0 deletions lib/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -48,5 +48,6 @@ export * from "./model-capability-matrix.js";
export * from "./policy/runtime-policy.js";
export * from "./local-bridge.js";
export * from "./local-client-tokens.js";
export * from "./providers/minimax.js";
export * from "./integration-generators.js";
export * from "./temp-path.js";
Loading