Summary

Migrates the MiniMax portal OAuth flow from the legacy api.{minimax.io,minimaxi.com}/oauth/* surface to the canonical account.{minimax.io,minimaxi.com}/oauth2/* surface, and finally implements the refresh path that extensions/minimax/provider-registration.ts:176 already promised users ("MiniMax OAuth tokens auto-refresh. Re-run login if refresh fails or access is revoked." — that note was aspirational; before this PR there was no refresh implementation, so a 2-day access_token expiry forced re-login).

The legacy endpoints still respond, but account/oauth2/* is what the MiniMax platform team treats as canonical and what the existing mmx-cli plus the in-flight Hermes (NousResearch/hermes-agent#25581) and opencode (anomalyco/opencode#27460) integrations target.

OpenClaw's existing 78257093-7e40-4613-99e0-527b14b39113 client_id is verified registered on the new backend for both global + CN, so no re-registration needed.

Endpoint migration (extensions/minimax/oauth.ts)

New refresh path

• oauth.ts exports refreshMiniMaxPortalOAuth({ refreshToken, region }) → MiniMaxOAuthToken. Throws clearly when the server signals the refresh_token is no longer valid (90-day window elapsed, token already rotated, grant revoked) — caller treats as re-login required.
• oauth.runtime.ts re-exports it for the existing lazy-import boundary.
• provider-registration.ts:
  • Login flow now persists enterpriseUrl: baseUrl on the OAuthCredential via credentialExtra, so the refresh callback can derive which region's OAuth backend to hit (the refreshOAuth contract only receives the credential).
  • The PORTAL provider's registerProvider({...}) block adds refreshOAuth: async (cred) => await refreshMiniMaxPortalOAuthCredential(cred), matching the established pattern from extensions/openai/openai-codex-provider.ts:582. The wrapper derives region from cred.enterpriseUrl (*.minimaxi.com ⇒ CN, else global), calls the refresh, returns the rotated credential.

Tests

• New extensions/minimax/oauth.test.ts (6 tests) covers:
  • global + CN endpoint URLs and grant_type=refresh_token body
  • server omits refresh_token → fall back to previous one
  • non-2xx → throws (re-login signal)
  • status≠"success" with HTTP 200 → throws (refresh_token_reused etc.)
  • missing access_token in success payload → throws
• extensions/minimax/index.test.ts mock for ./oauth.runtime.js now also stubs refreshMiniMaxPortalOAuth so tests that touch the new re-exported symbol don't see undefined.
• scripts/check-no-raw-channel-fetch.mjs allowlist updated to reflect new line numbers in oauth.ts after this patch (existing oauth.ts:107 → :106 after one removed body line, plus oauth.ts:254 for the new refresh fetch).

Real behavior proof

Behavior addressed: MiniMax portal OAuth login + token refresh in extensions/minimax/. Before this PR, login worked against the legacy api.*/oauth/* endpoints but refresh was never implemented, so users hit re-login every 2 days when the access_token expired.

Real environment tested: macOS local checkout on feat/minimax-oauth2-migrate-and-refresh. Build via pnpm openclaw (run-node.mjs path) against this branch's compiled output. Live OAuth round-trip against the production MiniMax OAuth backend with a real Token Plan account.

Exact steps or command run after this patch:

cd ~/src/openclaw
NODE_OPTIONS="--max-old-space-size=12288" pnpm openclaw models auth login --provider minimax-portal

Then in the interactive flow: select MiniMax OAuth (Global) at the auth-method picker, browser opens the verification URL, approve in browser.

Evidence after fix: verbatim terminal output from the run above (build chatter trimmed for readability).

$ node scripts/run-node.mjs models auth login --provider minimax-portal
[openclaw] Building TypeScript (dist is stale: missing_build_stamp - build stamp missing).
[openclaw] Building bundled plugin assets.
[canvas] build: node scripts/bundle-a2ui.mjs
A2UI bundle up to date; skipping.
runtime-postbuild: plugin SDK root alias completed in 0ms
runtime-postbuild: bundled plugin metadata completed in 142ms
runtime-postbuild: official channel catalog completed in 9ms
runtime-postbuild: bundled plugin runtime overlay completed in 377ms
runtime-postbuild: static extension assets completed in 26ms
runtime-postbuild: stable root runtime imports completed in 278ms
runtime-postbuild: stable root runtime aliases completed in 40ms
runtime-postbuild: legacy root runtime compat aliases completed in 9ms
runtime-postbuild: legacy CLI exit compat chunks completed in 0ms

🦞 OpenClaw 2026.5.14 (afcb4c3) — Your .zshrc wishes it could do what I do.

│
◇  Auth method for MiniMax
│  MiniMax OAuth (Global)
│
◑  Starting MiniMax OAuth (Global)…..│
◇  MiniMax OAuth ───────────────────────────────────────────────────────────────────────────╮
│                                                                                           │
│  Open https://platform.minimax.io/oauth-authorize?user_code=TUE3-FXNG&client=OpenClaw to  │
│  approve access.                                                                          │
│  If prompted, enter the code TUE3-FXNG.                                                   │
│  Interval: 3000, Expires at: 1778829961615 unix timestamp                                 │
│                                                                                           │
├───────────────────────────────────────────────────────────────────────────────────────────╯
◇  MiniMax OAuth complete
│
◇  MiniMax OAuth ──────────────────╮
│                                  │
│  Current Plan: Max – High-Speed  │
│  Valid until: 10/10/2026         │
│                                  │
├──────────────────────────────────╯
Updated ~/.openclaw/openclaw.json
Auth profile: minimax-portal:default (minimax-portal/oauth)
Default model available: minimax-portal/MiniMax-M2.7 (use --set-default to apply)
│
◇  Provider notes ─────────────────────────────────────────────────────────────────────────╮
│                                                                                          │
│  MiniMax OAuth tokens auto-refresh. Re-run login if refresh fails or access is revoked.  │
│  Base URL defaults to https://api.minimax.io/anthropic. Override                         │
│  models.providers.minimax-portal.baseUrl if needed.                                      │
│  Current Plan: Max – High-Speed                                                          │
│  Valid until: 10/10/2026                                                                 │
│                                                                                          │

Observed result after fix:

• Picker offered MiniMax OAuth (Global) → branch's createMinimaxOAuthMethod("global") registered correctly.
• Verification URL surfaced as https://platform.minimax.io/oauth-authorize?user_code=TUE3-FXNG&client=OpenClaw — the &client=OpenClaw query param confirms MiniMax's account.*/oauth2/* backend recognizes OpenClaw's existing 78257093-... client_id by name (no re-registration needed).
• Browser auto-opened; user approved in-browser; terminal printed MiniMax OAuth complete.
• Server returned plan metadata (Current Plan: Max – High-Speed, Valid until: 10/10/2026) → access_token + refresh_token successfully exchanged.
• Auth profile: minimax-portal:default (minimax-portal/oauth) written to ~/.openclaw/openclaw.json → credentials persisted.
• Default model available: minimax-portal/MiniMax-M2.7 → portal catalog resolution works under the new endpoint.

Local supplemental proof (additional to the runtime evidence above): pnpm test extensions/minimax → 11 test files / 115 tests all pass; pnpm tsgo:extensions:test produces zero minimax-scoped errors.

What was not tested:

• The 90-day refresh_token expiry path was not exercised live (would require sitting on a token for ~3 months and waiting for the server to revoke it). Behavior is covered by oauth.test.ts cases that exercise the server returning invalid_grant / refresh_token_reused / status="error" and assert refreshMiniMaxPortalOAuth throws.
• Actual refreshOAuth callback invocation by OAuthManager was not exercised end-to-end in this run (would require the access_token to age past expires while the OpenClaw process is running). Wired exactly per the established pattern in extensions/openai/openai-codex-provider.ts:582.
• The pre-existing pnpm check:changed typecheck failure in extensions/telegram/ (grammy / @grammyjs/types duplicate-package mismatch) is unrelated to this PR — it reproduces on origin/main without these changes. Did not address it here.

Notes

This PR makes good on the existing user-facing note "MiniMax OAuth tokens auto-refresh. Re-run login if refresh fails or access is revoked." (provider-registration.ts:176) — that text was previously aspirational. After this PR, refresh actually runs via the OpenClaw OAuthManager → refreshOAuth plugin hook → refreshMiniMaxPortalOAuthCredential, with proper failure semantics (90-day refresh_token expiry surfaces as a clean "re-login required" path instead of silent 401s).