From 5e92542bbf89990a77954da747fac5c657e6e4e6 Mon Sep 17 00:00:00 2001 From: hetaoBackend Date: Tue, 13 Oct 2026 20:50:02 +0800 Subject: [PATCH] docs: correct stale source and npm version references to 0.6.3 / 0.6.9 README, README_ZH, SECURITY, installation, open-source-status, release-audit, releasing, telemetry, tui-capabilities and verification still declared 0.4.12 while package.json is 0.6.3 and the published npm package is 0.6.9. The version and evidence baseline table named packages/tui/package.json as its source of truth while asserting a value that file contradicted. The data directory default was verified against the published 0.6.9 package before updating the references that name it. Historical records are intentionally left unchanged: the reviewed 0.4.12 import and shared-source baseline in docs/verification.md, the packages/tui CHANGELOG timelines, and release/extraction.json. --- README.md | 4 ++-- README_ZH.md | 4 ++-- SECURITY.md | 2 +- docs/installation.md | 12 ++++++------ docs/open-source-status.md | 10 +++++----- docs/release-audit.md | 2 +- docs/releasing.md | 2 +- docs/telemetry.md | 2 +- docs/tui-capabilities.md | 6 +++--- docs/verification.md | 2 +- 10 files changed, 23 insertions(+), 23 deletions(-) diff --git a/README.md b/README.md index cf518b604..11e2a0e71 100644 --- a/README.md +++ b/README.md @@ -82,7 +82,7 @@ mcode login --region global Complete sign-in in your browser, then open `mcode` and use `/status` to check your account and `/provider` to choose a model. Run `mcode logout` to sign out. -Token Plan requires an account with available credits. Builds from this repository and the published npm CLI `@minimax-ai/code@0.4.12` default to `~/.minimax` for user data (or `~/.minimax-` when a profile is selected). `MINIMAX_DATA_DIR` or `MAVIS_DATA_DIR` can override the data directory. The installer's `~/.minimax-code` installation directory is separate from this choice. See [Accounts and data](docs/installation.md#accounts-and-data) before locating or removing configuration and sessions. +Token Plan requires an account with available credits. Builds from this repository and the published npm CLI `@minimax-ai/code@0.6.9` default to `~/.minimax` for user data (or `~/.minimax-` when a profile is selected). `MINIMAX_DATA_DIR` or `MAVIS_DATA_DIR` can override the data directory. The installer's `~/.minimax-code` installation directory is separate from this choice. See [Accounts and data](docs/installation.md#accounts-and-data) before locating or removing configuration and sessions.
Use your own API key (BYOK) @@ -275,7 +275,7 @@ From the source directory, use `pnpm mcode` in place of `mcode` in the examples node /absolute/path/to/minimax-code/dist/cli.js ``` -This repository targets the **0.4.12 source preview**. Installing the published package and building this checkout are separate paths. Matching versions do not prove identical build provenance; see the [version and evidence baseline](docs/open-source-status.md#version-and-evidence-baseline). +This repository targets the **0.6.3 source preview**. Installing the published package and building this checkout are separate paths. Matching versions do not prove identical build provenance; see the [version and evidence baseline](docs/open-source-status.md#version-and-evidence-baseline). ## Documentation and contributing diff --git a/README_ZH.md b/README_ZH.md index 370efc0e8..18aea27a9 100644 --- a/README_ZH.md +++ b/README_ZH.md @@ -82,7 +82,7 @@ mcode login --region global 在浏览器中完成登录，再启动 `mcode`，通过 `/status` 检查账号、通过 `/provider` 选择模型。退出登录使用 `mcode logout`。 -Token Plan 需要账号与可用额度。从本仓库构建的版本与已发布的 npm CLI `@minimax-ai/code@0.4.12` 均默认将用户数据保存在 `~/.minimax`（选择 profile 时为 `~/.minimax-`）。`MINIMAX_DATA_DIR` 或 `MAVIS_DATA_DIR` 可以覆盖数据目录。安装脚本使用的 `~/.minimax-code` 安装目录与数据目录的选择是两回事。查找或删除配置和会话前，请参阅[账号与数据](docs/installation.md#accounts-and-data)。 +Token Plan 需要账号与可用额度。从本仓库构建的版本与已发布的 npm CLI `@minimax-ai/code@0.6.9` 均默认将用户数据保存在 `~/.minimax`（选择 profile 时为 `~/.minimax-`）。`MINIMAX_DATA_DIR` 或 `MAVIS_DATA_DIR` 可以覆盖数据目录。安装脚本使用的 `~/.minimax-code` 安装目录与数据目录的选择是两回事。查找或删除配置和会话前，请参阅[账号与数据](docs/installation.md#accounts-and-data)。
使用自己的 API Key（BYOK） @@ -272,7 +272,7 @@ pnpm mcode node /absolute/path/to/minimax-code/dist/cli.js ``` -本仓库目标为 **0.4.12 源码预览**。安装已发布的包与构建本仓库是两条独立路径，版本一致不代表构建来源完全相同，详见[版本与证据基线](docs/open-source-status.md#version-and-evidence-baseline)。 +本仓库目标为 **0.6.3 源码预览**。安装已发布的包与构建本仓库是两条独立路径，版本一致不代表构建来源完全相同，详见[版本与证据基线](docs/open-source-status.md#version-and-evidence-baseline)。 ## 文档与贡献 diff --git a/SECURITY.md b/SECURITY.md index 0b7ba6762..086a80323 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,7 +12,7 @@ Include the affected version, operating system and Node.js version, a minimal re ## Data and service boundaries -- The active data directory stores login state, provider configuration (including API keys in `config.yaml`), and sessions. Builds from this repository and the published npm CLI `@minimax-ai/code@0.4.12` default to `~/.minimax` (or `~/.minimax-` when a profile is selected). Environment overrides can select another directory. Follow [Accounts and data](docs/installation.md#accounts-and-data) to identify it; the installer location alone does not identify stored credentials. Restrict local access to every data directory you have used and keep them out of Git, including old profiles. They are not shareable project configuration. +- The active data directory stores login state, provider configuration (including API keys in `config.yaml`), and sessions. Builds from this repository and the published npm CLI `@minimax-ai/code@0.6.9` default to `~/.minimax` (or `~/.minimax-` when a profile is selected). Environment overrides can select another directory. Follow [Accounts and data](docs/installation.md#accounts-and-data) to identify it; the installer location alone does not identify stored credentials. Restrict local access to every data directory you have used and keep them out of Git, including old profiles. They are not shareable project configuration. - Models, official plugins, connectors, search, media, feedback, and telemetry may contact external services. Those services continue to control authorization and credits; source access does not grant access to accounts or third-party resources. - mcode-tools obtains short-lived access tokens through the host's lease broker. Never pass refresh tokens to tool processes. - Permissions and sandboxing do not replace review of untrusted plugins, MCP servers, and shell commands. If automatic permission classification is unavailable, retain user confirmation rather than allowing operations by default. diff --git a/docs/installation.md b/docs/installation.md index cfbc37819..eaa64b2af 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -31,13 +31,13 @@ the package, use `npm uninstall --global @minimax-ai/code`. User data remains in ## Install from source -The official CLI is available as [`@minimax-ai/code`](https://www.npmjs.com/package/@minimax-ai/code). Public npm `latest` was 0.4.12 on 2026-09-18. Follow the [official quick start](https://agent.minimax.io/docs/cli/quick-start) or the [README installation steps](../README.md#quick-start) for the macOS / Linux / WSL installer, Windows PowerShell installer, or npm installation. +The official CLI is available as [`@minimax-ai/code`](https://www.npmjs.com/package/@minimax-ai/code). Public npm `latest` was 0.6.9 on 2026-10-13. Follow the [official quick start](https://agent.minimax.io/docs/cli/quick-start) or the [README installation steps](../README.md#quick-start) for the macOS / Linux / WSL installer, Windows PowerShell installer, or npm installation. For npm, use the command in the README: it explicitly selects the public registry, includes optional dependencies, and allows the `@minimax-ai/code` and `better-sqlite3` lifecycle scripts. SQLite is declared optional in the package metadata, but a working native SQLite binding is required at runtime. Do not omit optional dependencies or disable installation scripts. On npm versions that enforce script approvals, `--allow-scripts` grants these two packages permission without allowing every dependency script. -`@latest` follows the stable npm dist-tag. For a reproducible CLI version, replace `@latest` with an exact published version such as `@0.4.12`, keeping the other options. Use Node.js 22.19+ (22.x), 24.2+ (24.x), 25, or 26 for both npm and source installations. +`@latest` follows the stable npm dist-tag. For a reproducible CLI version, replace `@latest` with an exact published version such as `@0.6.9`, keeping the other options. Use Node.js 22.19+ (22.x), 24.2+ (24.x), 25, or 26 for both npm and source installations. -This guide builds the 0.4.12 source preview. Workspace/local build manifests remain `private: true` to prevent accidental publishing. A source checkout may contain additional reviewed distribution changes; matching version strings alone do not establish byte-for-byte or build-provenance equivalence with the official npm tarball. Use the committed source revision and release receipt to identify a source build. +This guide builds the 0.6.3 source preview. Workspace/local build manifests remain `private: true` to prevent accidental publishing. A source checkout may contain additional reviewed distribution changes; matching version strings alone do not establish byte-for-byte or build-provenance equivalence with the official npm tarball. Use the committed source revision and release receipt to identify a source build. For a source build, you need Git, Node.js 22.19+ (22.x), 24.2+ (24.x), 25, or 26, and pnpm 9.12.0. Regular CI uses Node.js 24 across Linux and macOS. The weekly and manual compatibility matrix covers Node.js 22.19.0, 24.2.0, 25, and 26 on both platforms. Windows CI and source-candidate validation are temporarily paused while their checks are made reliable. Initial installation and build require access to public npm. @@ -77,10 +77,10 @@ Source builds and the published npm CLI use the same default user data directory | CLI artifact | Default user data directory | | --- | --- | -| Published npm `@minimax-ai/code@0.4.12` | `~/.minimax` | +| Published npm `@minimax-ai/code@0.6.9` | `~/.minimax` | | Build from this repository | `~/.minimax` | -The npm 0.4.12 default was checked against the [public registry artifact](https://registry.npmjs.org/@minimax-ai/code/0.4.12) on 2026-09-19, with its SHA-512 integrity verified. This applies to that published version, including local npm dependencies; do not infer the default of another release from its version label alone. A selected profile uses `~/.minimax-`. The source default is defined in [`data-dir.ts`](../packages/tui/src/runtime/data-dir.ts). Login state, provider configuration such as `config.yaml`, caches, and sessions belong to the selected data directory. +The npm 0.6.9 default was checked against the [public registry artifact](https://registry.npmjs.org/@minimax-ai/code/0.6.9) on 2026-10-13, with its SHA-512 integrity verified. This applies to that published version, including local npm dependencies; do not infer the default of another release from its version label alone. A selected profile uses `~/.minimax-`. The source default is defined in [`data-dir.ts`](../packages/tui/src/runtime/data-dir.ts). Login state, provider configuration such as `config.yaml`, caches, and sessions belong to the selected data directory. Both accept a non-empty `MINIMAX_DATA_DIR`, falling back to a non-empty `MAVIS_DATA_DIR`, before the default. The [macOS / Linux / WSL installer](https://filecdn.minimax.chat/public/install.sh) installs the npm package under `~/.minimax-code` by default (`MCODE_INSTALL_DIR` changes the installation location). It does not set either data-directory override. Installation files and user data are separate concerns, even when their directories have the same name. @@ -89,7 +89,7 @@ Earlier source builds used `~/.minimax-code` for user data. The new default does To locate data safely: 1. Identify the launcher you actually use with `command -v mcode` (POSIX) or `Get-Command mcode -All` (PowerShell), and run that launcher's `--version`. For a local npm dependency, use `node_modules/.bin/mcode --version`; a global npm listing does not identify it. A source build may report the same version as the npm release. -2. Check whether either data-directory override is set in that launcher's environment. Otherwise use the artifact-specific default above. Inspect directory and file names/permissions locally, without printing `config.yaml`, authentication files, or session contents. For builds from this repository, `mcode telemetry status` also reports the selected `configFile` path without printing credentials; npm 0.4.12 does not provide that command. +2. Check whether either data-directory override is set in that launcher's environment. Otherwise use the artifact-specific default above. Inspect directory and file names/permissions locally, without printing `config.yaml`, authentication files, or session contents. For builds from this repository, `mcode telemetry status` also reports the selected `configFile` path without printing credentials; npm 0.6.9 does not provide that command. 3. If both directories exist, their presence alone does not identify the active one. Keep both protected, and include the launcher, version, installation method, and whether overrides are set when requesting help. Redact personal path components; do not attach configuration or authentication files. Changing an override does not migrate existing data, so do not move or delete either directory merely to match these docs. For tests, explicitly set `MINIMAX_DATA_DIR` to a temporary directory to keep normal sessions separate. Use `$env:MINIMAX_DATA_DIR = 'C:\path\to\test-profile'` in PowerShell or `export MINIMAX_DATA_DIR=/path/to/test-profile` in a POSIX shell. diff --git a/docs/open-source-status.md b/docs/open-source-status.md index 8f426671c..783bb9be1 100644 --- a/docs/open-source-status.md +++ b/docs/open-source-status.md @@ -1,19 +1,19 @@ # Source status -The current source target is **TUI 0.4.12**. This repository contains the terminal TUI, headless CLI, ACP implementation, and the public distribution tooling around them. +The current source target is **TUI 0.6.3**. This repository contains the terminal TUI, headless CLI, ACP implementation, and the public distribution tooling around them. ## Version and evidence baseline | Concern | Current value | Source of truth | | --- | --- | --- | -| TUI capability version | 0.4.12 | `packages/tui/package.json` | -| Root workspace version | 0.4.12, aligned with the TUI | Root `package.json` | -| Published npm observation | `@minimax-ai/code@0.4.12`; npm `latest` was 0.4.12 on 2026-09-18 | Public npm registry | +| TUI capability version | 0.6.3 | `packages/tui/package.json` | +| Root workspace version | 0.6.3, aligned with the TUI | Root `package.json` | +| Published npm observation | `@minimax-ai/code@0.6.9`; npm `latest` was 0.6.9 on 2026-10-13 | Public npm registry | | Shared-source baseline | `9b9885e42a3cf1a3df1cfa52a46e4fdb034cfcee` | `release/extraction.json` | | Embedded mcode-tools | 0.0.4, extracted from public `@minimax-ai/code@0.3.11` | `scripts/lib/mcode-tools-artifact.mjs` | | Historical live-service acceptance and demo | TUI 0.3.11, recorded 2026-09-11 | `docs/verification.md`, `docs/release-audit.md`, `docs/demo.md` | -The product, TUI, and root workspace use the same 0.4.12 version. The embedded tool has its own version. Workspace and local-build manifests remain `private: true` to prevent accidental npm publication. Matching version strings do not prove that this source tree reproduces the published npm tarball. +The product, TUI, and root workspace use the same 0.6.3 version. The embedded tool has its own version. Workspace and local-build manifests remain `private: true` to prevent accidental npm publication. Matching version strings do not prove that this source tree reproduces the published npm tarball. ## Source boundary diff --git a/docs/release-audit.md b/docs/release-audit.md index 811a5ddac..c8335da13 100644 --- a/docs/release-audit.md +++ b/docs/release-audit.md @@ -1,6 +1,6 @@ # Private release audit -This audit describes the historical TUI 0.3.11 baseline. The current source target is TUI 0.4.12; see [source status](open-source-status.md) and [current verification status](verification.md#current-source-verification-status). The earlier pass results are not current-release acceptance. The repository boundary is documented in [Publication scope](publication-authorization.md). +This audit describes the historical TUI 0.3.11 baseline. The current source target is TUI 0.6.3; see [source status](open-source-status.md) and [current verification status](verification.md#current-source-verification-status). The earlier pass results are not current-release acceptance. The repository boundary is documented in [Publication scope](publication-authorization.md). Date: 2026-09-11. Scope: standalone TUI 0.3.11 source, retained capabilities, dependency provenance, Git history, and local build artifacts. Review and CI were requested before publication. GitHub was private at the time; no release or npm package was published by this audit. diff --git a/docs/releasing.md b/docs/releasing.md index 0d95eaed2..c984f7365 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -70,7 +70,7 @@ This workflow does not publish to the npm registry or change the official instal ## Source previews -The current source target is MiniMax Code 0.4.12. Workspace and local-build manifests remain `private: true` to prevent accidental npm publication. A source release, npm package, and installer are separate artifacts with separate verification. +The current source target is MiniMax Code 0.6.3. Workspace and local-build manifests remain `private: true` to prevent accidental npm publication. A source release, npm package, and installer are separate artifacts with separate verification. ## Prepare a release diff --git a/docs/telemetry.md b/docs/telemetry.md index 2136668d1..db83df802 100644 --- a/docs/telemetry.md +++ b/docs/telemetry.md @@ -4,7 +4,7 @@ All automatic telemetry uploads are disabled by default and each requires its ow ## Turn it on or off -Add this to the active profile's `config.yaml`, then restart MCode. Builds from this repository and the published npm CLI `@minimax-ai/code@0.4.12` default to `~/.minimax/config.yaml` (or `~/.minimax-/config.yaml` when a profile is selected). Overrides can change this path; see [Accounts and data](installation.md#accounts-and-data) to locate it. The telemetry controls below describe this repository's source build and are not a guarantee of feature parity with that npm release. +Add this to the active profile's `config.yaml`, then restart MCode. Builds from this repository and the published npm CLI `@minimax-ai/code@0.6.9` default to `~/.minimax/config.yaml` (or `~/.minimax-/config.yaml` when a profile is selected). Overrides can change this path; see [Accounts and data](installation.md#accounts-and-data) to locate it. The telemetry controls below describe this repository's source build and are not a guarantee of feature parity with that npm release. ```yaml telemetry: diff --git a/docs/tui-capabilities.md b/docs/tui-capabilities.md index e29b665e8..2ac374419 100644 --- a/docs/tui-capabilities.md +++ b/docs/tui-capabilities.md @@ -1,6 +1,6 @@ # TUI capability coverage -The current capability target is **TUI 0.4.12**; see [version and evidence baseline](open-source-status.md#version-and-evidence-baseline) for the separate workspace and embedded-tool versions. “Restored” below describes implementation and assembly, not acceptance of every account or online service. +The current capability target is **TUI 0.6.3**; see [version and evidence baseline](open-source-status.md#version-and-evidence-baseline) for the separate workspace and embedded-tool versions. “Restored” below describes implementation and assembly, not acceptance of every account or online service. ## Output speed @@ -77,7 +77,7 @@ terminal-tab indicator, not a guarantee of a desktop notification. See the Inside tmux, OSC notifications require passthrough and support from the outer terminal; use `method: bel` for a bell fallback. -The evidence column summarizes the historical TUI 0.3.11 restoration record from 2026-09-11. It does not claim fresh TUI 0.4.12 live-service acceptance. Use [current verification status](verification.md#current-source-verification-status) for checks run against the updated source and explicit NOT RUN boundaries. +The evidence column summarizes the historical TUI 0.3.11 restoration record from 2026-09-11. It does not claim fresh TUI 0.6.3 live-service acceptance. Use [current verification status](verification.md#current-source-verification-status) for checks run against the updated source and explicit NOT RUN boundaries. | Capability | Implementation | Evidence | | --- | --- | --- | @@ -190,7 +190,7 @@ Website deployment tools and routes follow the original tool set. Successful dep ## Release boundary -Production client paths are restored without internal registries or test-service addresses as build dependencies. Real account behavior, quota, billing, model quality, media generation, and deployment require separate acceptance. Mocks, protocol fixtures, successful builds, and the source import do not replace that evidence. Public npm `latest` was 0.4.12 on 2026-09-18; that metadata observation does not validate the installed package or deploy a backend. See [verification records](verification.md) and the historical [release audit](release-audit.md) for recorded acceptance results. +Production client paths are restored without internal registries or test-service addresses as build dependencies. Real account behavior, quota, billing, model quality, media generation, and deployment require separate acceptance. Mocks, protocol fixtures, successful builds, and the source import do not replace that evidence. Public npm `latest` was 0.6.9 on 2026-10-13; that metadata observation does not validate the installed package or deploy a backend. See [verification records](verification.md) and the historical [release audit](release-audit.md) for recorded acceptance results. ## Diagnostic upload privacy diff --git a/docs/verification.md b/docs/verification.md index 40f4deddc..053ec64de 100644 --- a/docs/verification.md +++ b/docs/verification.md @@ -20,7 +20,7 @@ The unused Team cycle engine and two unreferenced adapters are removed. Legacy q ## Current source verification status -The current source target is TUI **0.4.12**, with the separate versions described in [Source status](open-source-status.md#version-and-evidence-baseline). The import results above are the current repository baseline. The 0.3.11 results below remain a historical record and have not been relabeled as current acceptance. +The current source target is TUI **0.6.3**, with the separate versions described in [Source status](open-source-status.md#version-and-evidence-baseline). The import results above are the current repository baseline. The 0.3.11 results below remain a historical record and have not been relabeled as current acceptance. Fresh login/logout, cross-platform interactive acceptance, and a validated three-platform source candidate remain **NOT RUN / unavailable** for the imported revision. Add later results with their revision, environment, and scope instead of replacing the historical record.