npm - @polderlabs/bizar - Versions diffs - 4.4.10 → 4.4.12 - Mend

@polderlabs/bizar 4.4.10 → 4.4.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (21) hide show

package/bizar-dash/dist/assets/{main-Nq8Dq3VR.css → main-BKXEqU1w.css} +1 -1
package/bizar-dash/dist/assets/main-EK_fzXn_.js +352 -0
package/bizar-dash/dist/assets/main-EK_fzXn_.js.map +1 -0
package/bizar-dash/dist/assets/mobile-Dl1q7Cyq.js.map +1 -1
package/bizar-dash/dist/index.html +2 -2
package/bizar-dash/src/server/api.mjs +2 -0
package/bizar-dash/src/server/minimax.mjs +352 -0
package/bizar-dash/src/server/mods-loader.mjs +169 -1
package/bizar-dash/src/server/routes/_shared.mjs +15 -0
package/bizar-dash/src/server/routes/minimax.mjs +140 -0
package/bizar-dash/src/web/App.tsx +2 -0
package/bizar-dash/src/web/components/Topbar.tsx +2 -0
package/bizar-dash/src/web/lib/types.ts +12 -0
package/bizar-dash/src/web/main.tsx +1 -0
package/bizar-dash/src/web/styles/minimax-usage.css +371 -0
package/bizar-dash/src/web/views/MiniMaxUsage.tsx +543 -0
package/cli/bin.mjs +39 -6
package/cli/provision.mjs +182 -2
package/package.json +1 -1
package/bizar-dash/dist/assets/main-CEazNxxy.js +0 -347
package/bizar-dash/dist/assets/main-CEazNxxy.js.map +0 -1

package/bizar-dash/dist/index.html CHANGED Viewed

@@ -29,10 +29,10 @@
         }
       })();
     </script>
-    <script type="module" crossorigin src="/assets/main-CEazNxxy.js"></script>
+    <script type="module" crossorigin src="/assets/main-EK_fzXn_.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/mobile-Dl1q7Cyq.js">
     <link rel="stylesheet" crossorigin href="/assets/mobile-CsZQAswA.css">
-    <link rel="stylesheet" crossorigin href="/assets/main-Nq8Dq3VR.css">
+    <link rel="stylesheet" crossorigin href="/assets/main-BKXEqU1w.css">
   </head>
   <body>
     <div id="root"></div>

package/bizar-dash/src/server/api.mjs CHANGED Viewed

@@ -48,6 +48,7 @@ import { createDiagnosticsRouter } from './routes/diagnostics.mjs';
 import { createPairRouter } from './routes/pair.mjs';
 import { createThemesRouter } from './routes/themes.mjs';
 import { createNotificationsRouter } from './routes/notifications.mjs';
+import { createMinimaxRouter } from './routes/minimax.mjs';
 import { createMiscRouter } from './routes/misc.mjs';
 /**
@@ -118,6 +119,7 @@ export async function createApiRouter({
   router.use(createThemesRouter({ state }));
   router.use(createNotificationsRouter({ broadcast }));
   router.use(createArtifactsRouter({ state, broadcast, projectRoot }));
+  router.use(createMinimaxRouter({ state, broadcast }));
   router.use(createMiscRouter({ state, broadcast }));
   // /api/auth/* must be reachable WITHOUT the bearer token so a fresh

package/bizar-dash/src/server/minimax.mjs ADDED Viewed

@@ -0,0 +1,352 @@
+/**
+ * src/server/minimax.mjs
+ *
+ * v4.5.0 — MiniMax API client.
+ *
+ * Owns the network calls to platform.minimax.io for the Bizar
+ * dashboard. Two surfaces:
+ *
+ *  1. fetchRemains()  — the public `/v1/token_plan/remains` endpoint.
+ *     Returns the user's remaining Token Plan quota per model — both
+ *     5-hour rolling window and weekly window — including the reset
+ *     times for each. This is the headline data the user wants to see.
+ *
+ *  2. chatCompletion() — a thin wrapper around `/v1/chat/completions`
+ *     (OpenAI-compatible) for the dashboard's "Send a test prompt"
+ *     button. Also captures the `usage` block from the response so the
+ *     dashboard can show per-call consumption.
+ *
+ * The client always reads the API key from the user's settings
+ * (settings.minimax.apiKey) and never logs it. The base URL is
+ * configurable but defaults to `https://www.minimax.io` per the docs.
+ *
+ * Token Plan endpoints live on `www.minimax.io` (NOT `api.minimax.io`
+ * — the chat completions endpoint uses that one). The default
+ * `baseUrl` in the settings uses the Token Plan host so `fetchRemains`
+ * works out of the box.
+ *
+ * All network calls are guarded by a 10s timeout so a hung API
+ * never wedges the dashboard.
+ */
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+const HOME = homedir();
+const BIZAR_HOME = join(HOME, '.config', 'bizar');
+const CACHE_DIR = join(BIZAR_HOME, 'minimax');
+const CACHE_FILE = join(CACHE_DIR, 'remains-cache.json');
+// Default base URL. The docs say `https://www.minimax.io/v1/token_plan/remains`
+// (note: the `www` host, not `api`). Allow override per-user in settings.
+export const DEFAULT_BASE_URL = 'https://www.minimax.io';
+// Chat completions / OpenAI-style surface lives on api.minimax.io.
+export const DEFAULT_CHAT_BASE_URL = 'https://api.minimax.io/v1';
+// Models Bizar exposes by default in the dashboard.
+export const KNOWN_MODELS = [
+  'MiniMax-M3',
+  'MiniMax-M2.7',
+  'MiniMax-M2.5',
+  'MiniMax-M2.1',
+  'MiniMax-M2',
+];
+/**
+ * Read the merged settings.json and return the MiniMax config block.
+ * Never throws — returns sane defaults on parse failure.
+ */
+export function readMinimaxSettings() {
+  const file = join(BIZAR_HOME, 'settings.json');
+  if (!existsSync(file)) {
+    return defaultMinimaxSettings();
+  }
+  try {
+    const parsed = JSON.parse(readFileSync(file, 'utf8'));
+    const m = parsed.minimax;
+    if (!m || typeof m !== 'object') return defaultMinimaxSettings();
+    return {
+      enabled: m.enabled !== false,
+      apiKey: typeof m.apiKey === 'string' ? m.apiKey : '',
+      groupId: typeof m.groupId === 'string' ? m.groupId : 'default',
+      baseUrl: typeof m.baseUrl === 'string' ? m.baseUrl : DEFAULT_BASE_URL,
+      chatBaseUrl: typeof m.chatBaseUrl === 'string' ? m.chatBaseUrl : DEFAULT_CHAT_BASE_URL,
+    };
+  } catch {
+    return defaultMinimaxSettings();
+  }
+}
+export function defaultMinimaxSettings() {
+  return {
+    enabled: true,
+    apiKey: '',
+    groupId: 'default',
+    baseUrl: DEFAULT_BASE_URL,
+    chatBaseUrl: DEFAULT_CHAT_BASE_URL,
+  };
+}
+// ─── Cache (in-memory + disk) ──────────────────────────────────────────────
+/**
+ * In-memory snapshot of the last remains response. Avoids re-hitting the
+ * API on every dashboard render.
+ */
+let memoryCache = null;
+function readDiskCache() {
+  try {
+    if (!existsSync(CACHE_FILE)) return null;
+    const stat = require('node:fs').statSync(CACHE_FILE);
+    if (Date.now() - stat.mtimeMs > 5 * 60 * 1000) return null; // 5 min TTL
+    return JSON.parse(readFileSync(CACHE_FILE, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+function writeDiskCache(snapshot) {
+  try {
+    mkdirSync(CACHE_DIR, { recursive: true });
+    writeFileSync(CACHE_FILE, JSON.stringify(snapshot, null, 2) + '\n', 'utf8');
+  } catch {
+    /* best-effort */
+  }
+}
+export function clearRemainsCache() {
+  memoryCache = null;
+  try {
+    if (existsSync(CACHE_FILE)) {
+      require('node:fs').unlinkSync(CACHE_FILE);
+    }
+  } catch { /* best-effort */ }
+}
+/**
+ * Try in-memory → disk cache. Returns the cached snapshot or null.
+ */
+export function readCachedRemains() {
+  if (memoryCache) return memoryCache;
+  const fromDisk = readDiskCache();
+  if (fromDisk) {
+    memoryCache = fromDisk;
+    return fromDisk;
+  }
+  return null;
+}
+// ─── Network helpers ──────────────────────────────────────────────────────
+/**
+ * Fetch with a hard timeout. Uses undici (Node 18+ global fetch is
+ * fine but AbortSignal.timeout is simpler with node:fetch).
+ */
+async function fetchWithTimeout(url, opts = {}, timeoutMs = 10_000) {
+  const ctl = new AbortController();
+  const t = setTimeout(() => ctl.abort(), timeoutMs);
+  try {
+    return await fetch(url, { ...opts, signal: ctl.signal });
+  } finally {
+    clearTimeout(t);
+  }
+}
+// ─── Public API ────────────────────────────────────────────────────────────
+/**
+ * Hit /v1/token_plan/remains with the user's API key + group_id.
+ *
+ * Response shape:
+ *   {
+ *     model_remains: [
+ *       { model_name, current_interval_remaining_percent, current_weekly_remaining_percent,
+ *         start_time, end_time, remains_time, weekly_start_time, weekly_end_time,
+ *         weekly_remains_time, current_interval_total_count, current_interval_usage_count,
+ *         current_weekly_total_count, current_weekly_usage_count,
+ *         current_interval_status, current_weekly_status },
+ *       ...
+ *     ],
+ *     base_resp: { status_code, status_msg }
+ *   }
+ *
+ * Returns the raw response, augmented with `fetchedAt` and (if we got
+ * data) the per-model `endTimeISO` / `weeklyEndTimeISO` strings for
+ * convenient rendering in the UI.
+ */
+export async function fetchRemains({ apiKey, groupId = 'default', baseUrl = DEFAULT_BASE_URL, force = false } = {}) {
+  if (!apiKey || !apiKey.trim()) {
+    return { ok: false, error: 'no_api_key', message: 'MiniMax API key is not configured' };
+  }
+  if (!force) {
+    const cached = readCachedRemains();
+    if (cached && cached.apiKeyHint === maskKey(apiKey) && (Date.now() - cached.fetchedAt) < 60_000) {
+      return { ok: true, cached: true, ...cached };
+    }
+  }
+  const url = `${baseUrl.replace(/\/$/, '')}/v1/token_plan/remains?group_id=${encodeURIComponent(groupId)}`;
+  let resp;
+  try {
+    resp = await fetchWithTimeout(url, {
+      method: 'GET',
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+      },
+    });
+  } catch (err) {
+    return { ok: false, error: 'network_error', message: err.message || 'fetch failed' };
+  }
+  const text = await resp.text();
+  let body = null;
+  try { body = text ? JSON.parse(text) : null; } catch { /* keep as null */ }
+  if (!resp.ok) {
+    return {
+      ok: false,
+      error: `http_${resp.status}`,
+      message: body?.base_resp?.status_msg || resp.statusText || 'request failed',
+      status: resp.status,
+    };
+  }
+  if (!body || body.base_resp?.status_code !== 0) {
+    return {
+      ok: false,
+      error: 'api_error',
+      message: body?.base_resp?.status_msg || 'unknown error',
+      raw: body,
+    };
+  }
+  // Augment with ISO timestamps so the UI doesn't have to do ms → Date
+  // arithmetic for every cell.
+  const models = (body.model_remains || []).map((m) => ({
+    ...m,
+    endTimeISO: new Date(m.end_time).toISOString(),
+    weeklyEndTimeISO: new Date(m.weekly_end_time).toISOString(),
+    intervalResetInMs: m.remains_time,
+    weeklyResetInMs: m.weekly_remains_time,
+    intervalResetInHuman: humanizeDuration(m.remains_time),
+    weeklyResetInHuman: humanizeDuration(m.weekly_remains_time),
+    intervalConsumedPercent: clamp(100 - (m.current_interval_remaining_percent || 0), 0, 100),
+    weeklyConsumedPercent: clamp(100 - (m.current_weekly_remaining_percent || 0), 0, 100),
+    intervalUsed: m.current_interval_usage_count || 0,
+    intervalTotal: m.current_interval_total_count || 0,
+    weeklyUsed: m.current_weekly_usage_count || 0,
+    weeklyTotal: m.current_weekly_total_count || 0,
+  }));
+  const snapshot = {
+    ok: true,
+    fetchedAt: Date.now(),
+    apiKeyHint: maskKey(apiKey),
+    groupId,
+    baseUrl,
+    models,
+    baseResp: body.base_resp,
+  };
+  memoryCache = snapshot;
+  writeDiskCache(snapshot);
+  return snapshot;
+}
+/**
+ * Send a single chat-completion to /v1/chat/completions and return
+ * the parsed response + parsed `usage` block. Used by the dashboard's
+ * "Send a test prompt" button so the user can verify their key works
+ * and see live token usage.
+ */
+export async function chatCompletion({
+  apiKey,
+  prompt,
+  model = 'MiniMax-M3',
+  baseUrl = DEFAULT_CHAT_BASE_URL,
+  maxTokens = 256,
+} = {}) {
+  if (!apiKey || !apiKey.trim()) {
+    return { ok: false, error: 'no_api_key', message: 'MiniMax API key is not configured' };
+  }
+  if (!prompt || !prompt.trim()) {
+    return { ok: false, error: 'no_prompt', message: 'prompt is empty' };
+  }
+  const url = `${baseUrl.replace(/\/$/, '')}/chat/completions`;
+  const body = JSON.stringify({
+    model,
+    messages: [{ role: 'user', content: prompt }],
+    max_completion_tokens: maxTokens,
+    stream: false,
+  });
+  let resp;
+  try {
+    resp = await fetchWithTimeout(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+      },
+      body,
+    });
+  } catch (err) {
+    return { ok: false, error: 'network_error', message: err.message || 'fetch failed' };
+  }
+  const text = await resp.text();
+  let data = null;
+  try { data = text ? JSON.parse(text) : null; } catch { /* ignore */ }
+  if (!resp.ok) {
+    return {
+      ok: false,
+      error: `http_${resp.status}`,
+      message: data?.base_resp?.status_msg || resp.statusText || 'request failed',
+      status: resp.status,
+      raw: data,
+    };
+  }
+  if (!data || data.base_resp?.status_code !== 0) {
+    return {
+      ok: false,
+      error: 'api_error',
+      message: data?.base_resp?.status_msg || 'unknown error',
+      raw: data,
+    };
+  }
+  const choice = (data.choices || [])[0] || {};
+  const content = choice?.message?.content || '';
+  return {
+    ok: true,
+    model: data.model || model,
+    content,
+    reasoning: choice?.message?.reasoning_content || null,
+    finishReason: choice?.finish_reason || null,
+    usage: data.usage || null,
+    baseResp: data.base_resp,
+  };
+}
+// ─── Helpers ────────────────────────────────────────────────────────────────
+/** Mask the API key for safe logging / display. Shows last 4 chars. */
+export function maskKey(key) {
+  if (!key) return '';
+  const trimmed = String(key).trim();
+  if (trimmed.length <= 6) return '****';
+  return `****${trimmed.slice(-4)}`;
+}
+/** Convert a millisecond duration into a compact human label. */
+export function humanizeDuration(ms) {
+  if (typeof ms !== 'number' || !Number.isFinite(ms) || ms <= 0) return 'now';
+  const sec = Math.floor(ms / 1000);
+  const min = Math.floor(sec / 60);
+  const hr = Math.floor(min / 60);
+  const day = Math.floor(hr / 24);
+  if (day >= 1) return `${day}d ${hr % 24}h`;
+  if (hr >= 1) return `${hr}h ${min % 60}m`;
+  if (min >= 1) return `${min}m`;
+  return `${sec}s`;
+}
+function clamp(n, lo, hi) {
+  return Math.max(lo, Math.min(hi, n));
+}

package/bizar-dash/src/server/mods-loader.mjs CHANGED Viewed

@@ -178,6 +178,138 @@ export const modsLoader = {
     mkdirSync(MODS_DIR, { recursive: true });
   },
+  /**
+   * v4.4.11 — Validate an installed mod without mounting it.
+   *
+   * Runs after a copy (in `installFromPath` + `installFromRegistry`) and
+   * before the install is reported as successful. Returns a structured
+   * `{ ok, errors, warnings }` so callers (the API + the CLI + the
+   * provisioner) can surface failures consistently.
+   *
+   * Checks performed:
+   *   1. `mod.json` is valid JSON with required fields (id, name, version).
+   *   2. `entry.route` (if declared) is a file that exists and is readable.
+   *      We pre-parse it with `node --check` to catch syntax errors.
+   *   3. Permissions declared in mod.json are validated against the
+   *      allowed list (delegates to mod-security.mjs).
+   *   4. If `entry.validate` is declared, we dynamic-import that file
+   *      and call its `default` or named `validate` export. The hook can
+   *      throw to fail the install.
+   *
+   * Never throws — always returns a structured result.
+   */
+  async validateModInstallation(id) {
+    const errors = [];
+    const warnings = [];
+    const dir = join(MODS_DIR, id);
+    if (!existsSync(dir)) {
+      return { ok: false, errors: [`mod directory not found: ${dir}`], warnings };
+    }
+    // 1. mod.json valid + required fields
+    const manifest = safeReadJSON(join(dir, 'mod.json'), null);
+    if (!manifest || typeof manifest !== 'object') {
+      return {
+        ok: false,
+        errors: ['mod.json is missing or invalid JSON'],
+        warnings,
+      };
+    }
+    for (const field of ['id', 'name', 'version']) {
+      if (!manifest[field] || typeof manifest[field] !== 'string') {
+        errors.push(`mod.json is missing required field "${field}"`);
+      }
+    }
+    if (manifest.id && manifest.id !== id) {
+      errors.push(`mod.json "id" field ("${manifest.id}") does not match the directory name ("${id}")`);
+    }
+    // 2. entry.route exists + parses
+    const entry = manifest.entry || {};
+    if (entry.route) {
+      const routePath = join(dir, entry.route);
+      if (!existsSync(routePath)) {
+        errors.push(`entry.route "${entry.route}" does not exist at ${routePath}`);
+      } else {
+        // Pre-parse the route.mjs with `node --check` to catch syntax
+        // errors without executing it. Skipped if node is not available.
+        try {
+          const { spawnSync } = await import('node:child_process');
+          const probe = spawnSync(process.execPath, ['--check', routePath], {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            timeout: 5000,
+          });
+          if (probe.status !== 0) {
+            // Extract the first error line from the syntax checker
+            // output. `node --check` prints something like:
+            //   /path/to/route.mjs:5
+            //   syntax is wrong here
+            //   ^^^
+            //   SyntaxError: message
+            // We want the last "SyntaxError:" line.
+            const stderr = (probe.stderr || '').toString();
+            const lines = stderr.split('\n').map((l) => l.trim()).filter(Boolean);
+            const errLine = lines.reverse().find((l) => l.toLowerCase().includes('syntaxerror')) || lines[0] || 'unknown';
+            errors.push(`entry.route "${entry.route}" has a syntax error: ${errLine}`);
+          }
+        } catch {
+          // node --check unavailable — skip (not fatal)
+        }
+      }
+    }
+    // 3. Permissions valid
+    if (Array.isArray(manifest.permissions)) {
+      const { invalid } = parsePermissions(manifest.permissions);
+      for (const p of invalid) {
+        warnings.push(`mod declares unknown permission: ${p}`);
+      }
+    }
+    // 4. Optional entry.validate hook
+    if (entry.validate) {
+      const validatePath = join(dir, entry.validate);
+      if (!existsSync(validatePath)) {
+        errors.push(`entry.validate "${entry.validate}" does not exist at ${validatePath}`);
+      } else {
+        try {
+          // Dynamic import — the validate hook is opt-in. The mod may
+          // export `default` (function) or named export `validate`.
+          const mod = await import(/* @vite-ignore */ `file://${validatePath}`);
+          const fn = mod.default || mod.validate;
+          if (typeof fn !== 'function') {
+            warnings.push(
+              `entry.validate "${entry.validate}" does not export a function (got ${typeof fn})`,
+            );
+          } else {
+            // Run the validate hook with a 5s timeout. The hook is
+            // trusted (it's part of the mod) but we don't want a bad
+            // hook to hang the install.
+            const result = await Promise.race([
+              Promise.resolve()
+                .then(() => fn({ mod: manifest, dir }))
+                .catch((err) => ({ ok: false, error: err.message })),
+              new Promise((resolve) =>
+                setTimeout(() => resolve({ ok: false, error: 'validate hook timed out after 5s' }), 5000),
+              ),
+            ]);
+            if (result && result.ok === false) {
+              errors.push(`mod validate hook failed: ${result.error || 'unknown'}`);
+            }
+          }
+        } catch (err) {
+          errors.push(`failed to load entry.validate "${entry.validate}": ${err.message}`);
+        }
+      }
+    }
+    return {
+      ok: errors.length === 0,
+      errors,
+      warnings,
+    };
+  },
   /** List all installed mods. v3.3.1 — never throws. */
   list() {
     try {
@@ -211,7 +343,7 @@ export const modsLoader = {
    * Install a mod from a local path. Copies the folder into
    * `~/.config/bizar/mods/<id>/`. The id is the source folder's basename.
    */
-  installFromPath(sourcePath) {
+  async installFromPath(sourcePath) {
     if (!existsSync(sourcePath)) {
       throw new Error(`source path does not exist: ${sourcePath}`);
     }
@@ -243,6 +375,24 @@ export const modsLoader = {
     // (agents/, commands/, skills/). This makes the mod's rules binding
     // on every agent at session start.
     installModInstructions(id, target);
+    // v4.4.11 — Smoke-test the mod before reporting success. We
+    // uninstall on failure so a broken mod doesn't leave a half-
+    // copied directory the user has to clean up manually.
+    const validation = await this.validateModInstallation(id);
+    if (!validation.ok) {
+      uninstallModInstructions(id);
+      rmSync(target, { recursive: true, force: true });
+      const err = new Error(
+        `mod "${id}" failed post-install validation: ${validation.errors.join('; ')}`,
+      );
+      err.validation = validation;
+      throw err;
+    }
+    if (validation.warnings.length > 0) {
+      console.warn(
+        `[mods-loader] mod "${id}" installed with warnings: ${validation.warnings.join('; ')}`,
+      );
+    }
     return loadMod({ id, dir: target });
   },
@@ -494,6 +644,24 @@ export const modsLoader = {
     // v3.20 — install mod instructions into the user's opencode config
     // (agents/, commands/, skills/). Triggered on registry install too.
     installModInstructions(id, target);
+    // v4.4.11 — Smoke-test the mod before reporting success. We
+    // uninstall on failure so a broken mod doesn't leave a half-
+    // copied directory the user has to clean up manually.
+    const validation = await this.validateModInstallation(id);
+    if (!validation.ok) {
+      uninstallModInstructions(id);
+      rmSync(target, { recursive: true, force: true });
+      const err = new Error(
+        `mod "${id}" failed post-install validation: ${validation.errors.join('; ')}`,
+      );
+      err.validation = validation;
+      throw err;
+    }
+    if (validation.warnings.length > 0) {
+      console.warn(
+        `[mods-loader] mod "${id}" installed with warnings: ${validation.warnings.join('; ')}`,
+      );
+    }
     return loadMod({ id, dir: target });
   },

package/bizar-dash/src/server/routes/_shared.mjs CHANGED Viewed

@@ -134,6 +134,20 @@ export const DEFAULT_SETTINGS = {
     provider: 'opencode',
     model: 'opencode/deepseek-v4-flash-free',
   },
+  // v4.5.0 — MiniMax Token Plan integration. `apiKey` is the
+  // user's Subscription Key from
+  //   https://platform.minimax.io/user-center/payment/token-plan
+  // `groupId` is usually 'default' for an individual team. `baseUrl`
+  // is the Token Plan host (the remains endpoint lives on www.*, NOT
+  // api.*). `chatBaseUrl` is the chat-completions host (api.*).
+  // No key is shipped by default — the user enters their own.
+  minimax: {
+    enabled: true,
+    apiKey: '',
+    groupId: 'default',
+    baseUrl: 'https://www.minimax.io',
+    chatBaseUrl: 'https://api.minimax.io/v1',
+  },
 };
 /**
@@ -159,6 +173,7 @@ export function mergeSettings(existing) {
   merged.about = { ...DEFAULT_SETTINGS.about, ...(existing.about || {}) };
   merged.agents = { ...DEFAULT_SETTINGS.agents, ...(existing.agents || {}) };
   merged.systemLlm = { ...DEFAULT_SETTINGS.systemLlm, ...(existing.systemLlm || {}) };
+  merged.minimax = { ...DEFAULT_SETTINGS.minimax, ...(existing.minimax || {}) };
   // Always use the package version — never let user settings override it
   merged.about.version = DEFAULT_SETTINGS.about.version;
   return merged;