{"id":"f46d1c0e-68e4-4062-a931-c1df5c6cadac","entityType":"agent","slug":"clawhub-wangjipeng977-minimax-monitor","name":"Minimax Monitor","canonicalUrl":"https://www.xpersona.co/agent/clawhub-wangjipeng977-minimax-monitor","canonicalPath":"/agent/clawhub-wangjipeng977-minimax-monitor","generatedAt":"2026-10-14T11:23:48.425Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T23:41:01.329Z","emptyReason":null},"description":"Use when (1) user says \"mmx 仪表盘启动\" / \"mmx monitor\" / \"MiniMax 配额查询\" / \"打开 minimax 监控\" and wants a real-time dashboard. (2) user wants to check how much of th...","descriptionLabel":"Source description","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. 974 downloads reported by the source. Last updated 10/11/2026.","installCommand":"clawhub skill install s179qwqch3yp9926afz4rxbz0h85z9mm:minimax-monitor","sourceUrl":"https://clawhub.ai/wangjipeng977/minimax-monitor","homepage":"https://clawhub.ai/wangjipeng977/skills/minimax-monitor","primaryLinks":[{"label":"View on ClawHub","url":"https://clawhub.ai/wangjipeng977/minimax-monitor","kind":"source"},{"label":"Homepage","url":"https://clawhub.ai/wangjipeng977/skills/minimax-monitor","kind":"homepage"}],"safetyScore":84,"overallRank":62,"popularityScore":60,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"Minimax Monitor technical dossier on Xpersona with agent coverage, OPENCLEW support, and live trust metadata."},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-10-11T23:41:01.329Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[],"verifiedCount":0,"selfDeclaredCount":1,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile"}},"adoption":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T23:41:01.329Z","emptyReason":null},"stars":null,"forks":null,"downloads":974,"likes":null,"task":null,"library":null,"packageName":null,"latestVersion":"1.7.0","tractionLabel":"974 downloads"},"release":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T23:41:01.253Z","emptyReason":null},"lastUpdatedAt":"2026-10-11T23:41:01.329Z","lastCrawledAt":"2026-10-11T23:41:01.253Z","lastIndexedAt":null,"nextCrawlAt":"2026-10-12T23:41:01.253Z","lastVerifiedAt":null,"highlights":[{"version":"1.7.0","createdAt":"2026-07-03T08:55:59.374Z","changelog":"test","fileCount":9,"zipByteSize":37241},{"version":"1.6.7","createdAt":"2026-06-30T06:09:23.331Z","changelog":"fix: 加载本地凭证按钮 success 判断 d.key → d.loaded (v1.6.1 之后 server 响应不回完整 key,前端必须改用 loaded 字段)。前端不再持有 key,新增 credLoaded 标记,fetchQuota/probe 不传 X-MMX-API-Key header,整条链路靠 server credLoadedKey。按钮文本简化 ✅ 已加载 (无 key 前缀)。","fileCount":9,"zipByteSize":34859},{"version":"1.6.6","createdAt":"2026-06-30T05:21:30.356Z","changelog":"docs: 本地展示位统一到 v1.6.6 (README Current Version / SKILL.md metadata.version / 功能段标题 全部 1.6.6 一致)。删 SKILL.md frontmatter 顶层残留 version 字段避免 ClawHub 解析冲突。CHANGELOG 补 v1.6.5/v1.6.6 段。","fileCount":9,"zipByteSize":34235},{"version":"1.6.5","createdAt":"2026-06-30T05:18:24.632Z","changelog":"docs: bump README/SKILL.md 显示到 v1.6.3 (删残留顶层 version: 1.6.2 字段, ClawHub 解析优先顶层 key 导致页面显示旧版) — SKILL.md metadata.version 同步到发布版本号","fileCount":9,"zipByteSize":34087},{"version":"1.6.4","createdAt":"2026-06-30T05:17:45.017Z","changelog":"docs: bump README/SKILL.md 显示到 v1.6.3 (删残留顶层 version: 1.6.2 字段, ClawHub 解析优先顶层 key 导致页面显示旧版)","fileCount":9,"zipByteSize":34111},{"version":"1.6.3","createdAt":"2026-06-30T04:17:14.560Z","changelog":"fix(security): /api/probe 拒绝空 Referer (与 load_cred 对齐); 加载本地凭证后 API key 不再写回 input.value (key 仅存内存变量,input 显示占位符 + data-loaded=1 标记)。修复 ClawHub 审计剩余 2 个 93% confidence finding。","fileCount":9,"zipByteSize":33912},{"version":"1.6.2","createdAt":"2026-06-29T07:35:13.942Z","changelog":"v1.6.2 docs cleanup SKILL.md 删「## 更新日志」整段（v1.6.0/v1.5.0/v1.4.0/...）+ 删 Security 重复 + 删冗余「技能简介/触发词收敛/文件说明/使用方式/环境变量/注意事项」段。ClawHub 全文渲染页面只展示 v1.6.2 功能 + 安全 + Modes/Do not/Quality Bar/Good vs Bad。 README.md / README_zh.md 重写，顶部只放「Current Version: v1.6.2」+「Features (v1.6.2)」+ Quick Start + Security + Configuration + FAQ，不堆 Changelog 历史。 CHANGELOG.md 重写保留累积变更（行业惯例），精简每版条目、去掉审计器 finding 编号等内部叙事噪音。 Hit Score 12.5/15 保持。代码无变更（安全修复继续走 v1.6.1）。","fileCount":9,"zipByteSize":33436},{"version":"1.6.1","createdAt":"2026-06-29T07:18:37.287Z","changelog":"test","fileCount":9,"zipByteSize":45878}]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install s179qwqch3yp9926afz4rxbz0h85z9mm:minimax-monitor","setupComplexity":"low","setupSteps":["Install using `clawhub skill install s179qwqch3yp9926afz4rxbz0h85z9mm:minimax-monitor` in an isolated environment before connecting it to live workloads.","No published capability contract is available yet, so validate auth and request/response behavior manually.","Review the upstream CLAWHUB listing at https://clawhub.ai/wangjipeng977/minimax-monitor before using production credentials."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-wangjipeng977-minimax-monitor/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-wangjipeng977-minimax-monitor/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-wangjipeng977-minimax-monitor/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-wangjipeng977-minimax-monitor/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-wangjipeng977-minimax-monitor/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-wangjipeng977-minimax-monitor/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-14T11:23:48.423Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-wangjipeng977-minimax-monitor/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-wangjipeng977-minimax-monitor/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-wangjipeng977-minimax-monitor/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-wangjipeng977-minimax-monitor/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T23:41:01.329Z","emptyReason":null},"readme":"Skill: Minimax Monitor\n\nOwner: wangjipeng977\n\nSummary: Use when (1) user says \"mmx 仪表盘启动\" / \"mmx monitor\" / \"MiniMax 配额查询\" / \"打开 minimax 监控\" and wants a real-time dashboard. (2) user wants to check how much of th...\n\nTags: latest:1.7.0\n\nVersion history:\n\nv1.7.0 | 2026-07-03T08:55:59.374Z | user\n\ntest\n\nv1.6.7 | 2026-06-30T06:09:23.331Z | user\n\nfix: 加载本地凭证按钮 success 判断 d.key → d.loaded (v1.6.1 之后 server 响应不回完整 key,前端必须改用 loaded 字段)。前端不再持有 key,新增 credLoaded 标记,fetchQuota/probe 不传 X-MMX-API-Key header,整条链路靠 server credLoadedKey。按钮文本简化 ✅ 已加载 (无 key 前缀)。\n\nv1.6.6 | 2026-06-30T05:21:30.356Z | user\n\ndocs: 本地展示位统一到 v1.6.6 (README Current Version / SKILL.md metadata.version / 功能段标题 全部 1.6.6 一致)。删 SKILL.md frontmatter 顶层残留 version 字段避免 ClawHub 解析冲突。CHANGELOG 补 v1.6.5/v1.6.6 段。\n\nv1.6.5 | 2026-06-30T05:18:24.632Z | user\n\ndocs: bump README/SKILL.md 显示到 v1.6.3 (删残留顶层 version: 1.6.2 字段, ClawHub 解析优先顶层 key 导致页面显示旧版) — SKILL.md metadata.version 同步到发布版本号\n\nv1.6.4 | 2026-06-30T05:17:45.017Z | user\n\ndocs: bump README/SKILL.md 显示到 v1.6.3 (删残留顶层 version: 1.6.2 字段, ClawHub 解析优先顶层 key 导致页面显示旧版)\n\nv1.6.3 | 2026-06-30T04:17:14.560Z | user\n\nfix(security): /api/probe 拒绝空 Referer (与 load_cred 对齐); 加载本地凭证后 API key 不再写回 input.value (key 仅存内存变量,input 显示占位符 + data-loaded=1 标记)。修复 ClawHub 审计剩余 2 个 93% confidence finding。\n\nv1.6.2 | 2026-06-29T07:35:13.942Z | user\n\nv1.6.2 docs cleanup\n\nSKILL.md 删「## 更新日志」整段（v1.6.0/v1.5.0/v1.4.0/...）+ 删 Security 重复 + 删冗余「技能简介/触发词收敛/文件说明/使用方式/环境变量/注意事项」段。ClawHub 全文渲染页面只展示 v1.6.2 功能 + 安全 + Modes/Do not/Quality Bar/Good vs Bad。\n\nREADME.md / README_zh.md 重写，顶部只放「Current Version: v1.6.2」+「Features (v1.6.2)」+ Quick Start + Security + Configuration + FAQ，不堆 Changelog 历史。\n\nCHANGELOG.md 重写保留累积变更（行业惯例），精简每版条目、去掉审计器 finding 编号等内部叙事噪音。\n\nHit Score 12.5/15 保持。代码无变更（安全修复继续走 v1.6.1）。\n\nv1.6.1 | 2026-06-29T07:18:37.287Z | user\n\ntest\n\nArchive index:\n\nArchive v1.7.0: 9 files, 37241 bytes\n\nFiles: CHANGELOG.md (9410b), CONTRIBUTING.md (2173b), mmx-monitor-server.js (23014b), mmx-monitor.html (33280b), README_zh.md (6496b), README.md (5905b), skill-card.md (2314b), SKILL.md (11720b), _meta.json (134b)\n\nFile v1.7.0:SKILL.md\n\n---\nname: minimax-monitor\ndescription: >\n  Use when (1) user says \"mmx 仪表盘启动\" / \"mmx monitor\" / \"MiniMax 配额查询\" / \"打开 minimax 监控\" and wants a real-time dashboard.\n  (2) user wants to check how much of their MiniMax Token Plan quota is left (4h / 24h / weekly windows for M3 / M2.7 / video / music / image models).\n  (3) user wants to test MiniMax inference latency (TTFT / P50 / burst) by clicking \"开始速率测试\" - explicitly opt-in, NOT background.\nlicense: MIT\nmetadata:\n  version: \"1.7.0\"\n  category: dev-tools\n  author: wangjipeng\n  sources:\n    - https://github.com/MiniMax-AI/skills\npermissions:\n  - read:filesystem       # ~/.mmx/config.json (v1.7.0: 按需读,不缓存)\n  - write:filesystem      # history.jsonl (24h ring buffer, 本技能目录)\n  - read:env               # MINIMAX_API_KEY\n  - network:outbound       # api.minimaxi.com / www.minimaxi.com\n  - shell:exec             # 'open' 命令启动浏览器\n---\n\n# MiniMax 套餐监控 + 速率测试中心\n\n> **触发词**:mmx 仪表盘启动\n>\n> **两个职责**:\n> 1. **实时配额查询** -- 60s 轮询官方 token_plan API,显示 4h / 24h / 本周用量、模型卡片、24h 趋势。\n> 2. **按需速率测试** -- 用户点 \"开始速率测试\" 按钮才发起 5 次 chat completion 请求(约 180 token 上限),返回 TTFT / P50 / burst / token-s。\n>\n> 启动后自动用 `open` 命令唤起浏览器打开 `http://127.0.0.1:9877/`。\n\n## v1.7.0 主要功能 (v1.6.7 → v1.7.0 增量)\n\n### v1.7.0 安全加固\n\n- 🔒 **凭证不在 server 进程内存中常驻**(v1.6.x → v1.7.0 重大变更)。每次需要 API key 的请求由 `loadKeyForRequest()` 现读 `~/.mmx/config.json`,用完即出栈,Node.js GC 一轮后释放。**进程内存 dump 拿不到完整 key**(lldb 验证: `memory find --string \"sk-cp-\"` 在 rw 段无命中)。\n- 🔒 **`/api/load_cred` 不再写入模块作用域**。仅向前端返回\"凭证已就绪\"标记 + `keyLength`/`keyPrefix`(前 6 字符)。前端 `credLoaded=true` 现在是 UX 标记,不再控制权限。\n\n### 安全 (v1.6.x 累计)\n\n- 🔒 **本地凭证按需加载**。Server 启动**不读** `~/.mmx/config.json`。用户在仪表盘顶部点 \"加载本地凭证\" 按钮 + `confirm()` 二次确认后,才通过 `POST /api/load_cred` 读取 API key。Server 重启后 key 丢失(v1.7.0 起 key 也从不进 server 内存,仅磁盘上原生存在的 `~/.mmx/config.json`)。\n- 🔒 **`/api/load_cred` 响应不含完整 API key**(只回 `keyLength` + `keyPrefix` 前 6 字符用于视觉确认)。\n- 🔒 **`/api/load_cred` 拒绝空 Referer**,强制 `Referer` 是本机白名单 `127.0.0.1 / localhost / file://` 之一。\n- 🔒 **CORS 严格**:`Access-Control-Allow-Origin` 仅放行 `127.0.0.1 / localhost / file://`。恶意网页无法跨域调本机 server 消耗你的 MiniMax 配额。\n- 🔒 **速率测试按需**:`/api/probe` 不再后台定时调用。仅在用户点 \"开始速率测试\" 按钮时才发起 5 次 chat completion,UI 红字提示 + 二次确认。\n\n### 配额监控\n\n- 📊 **4 小时 / 24 小时 / 本周** 三档用量追踪(4 小时为主圆环,按用户当前 Token Plan 套餐的实际周期动态显示)。\n- 🎯 **模型卡片** 区分 4h 限额 / 24h 限额 / 周无限额 / 套餐未启用(视频模型 status=3 元数据不可区分时显示 \"套餐未启用 · 不可调用\" 提示并排除出 4h 聚合)。\n- 📈 **24 小时趋势线**:`history.jsonl` 滚动 buffer(本技能目录)记录每次 `token_plan` 调用的用量快照,前端画趋势线。\n\n### 速率测试\n\n- ⚡ **TTFT / P50 / 突发并发 / token·s** 四项指标,基于真实 chat completion 请求。\n- ⚠️ **UI 红字 + confirm()** 提示每次测试消耗约 180 token,需用户主动确认。\n\n### 启动\n\n```bash\nnode ~/.openclaw/workspace/skills/minimax-monitor/mmx-monitor-server.js\n# 浏览器访问 http://127.0.0.1:9877/\n```\n\n高级选项:\n\n```bash\n# 启用 X-MMX-API-Key header 透传(默认拒绝)\nnode mmx-monitor-server.js --allow-header-key\n# 完全关闭速率测试端点\nnode mmx-monitor-server.js --no-probe\n```\n\n## Security & Data Flow\n\n本技能默认会:\n\n1. **按需读取本地凭证(v1.7.0: 不进内存)**:从 `~/.mmx/config.json` 读取 `api_key`(MiniMax Token Plan key)。**仅在用户主动点击 \"加载本地凭证\" 按钮时才会读**(`POST /api/load_cred`),server 启动时**不**读。**v1.7.0 起**:读到的 key 不写进 server 进程内存,每次需要时由 `loadKeyForRequest()` 现读磁盘、用完即出栈。`POST /api/load_cred` 仅返回\"已就绪\"标记 + `keyLength`/`keyPrefix`,不返回完整 key。\n2. **定时调用 MiniMax API**:每 60s 调 `https://www.minimaxi.com/v1/token_plan/remains` 拿配额数据。\n3. **写入本地采样数据**:每次 `fetchQuota` 后向 `<skill-dir>/history.jsonl` 追加一行 `(timestamp, usedPct, modelSnapshot)`,保留最近 24h 滚动 buffer,供前端画趋势线。不存凭证、不存个人信息。\n4. **速率测试需用户主动触发**:v1.6.0 起,仪表盘速率面板**不再自动**调用 chat completion。点 \"开始速率测试\" 按钮才会发起 5 次真实 chat 请求(约 180 token 上限),UI 会有红字提示 + 二次确认。\n\n**不会做**:\n\n- 不会把 API key 上传到任何远程(仅本地使用)。\n- 不会在 `load_cred` 响应里返回 key。\n- 不会把 key 存进 server 进程内存(v1.7.0 起);每次现读磁盘用完即出栈。\n- 不会允许跨源网页调用本机 server(CORS allowlist 限定 `127.0.0.1 / localhost / file://`)。\n- 不会接受空 Referer 调 `load_cred`(强制本机页面发起的请求才放行)。\n- 不会在后台悄悄消耗你的 chat 配额(v1.6.0 起 probe 改按需触发;不点不动)。\n\n**操作风险提示**:\n\n- **本地凭证访问**:点击 \"加载本地凭证\" 按钮会让 server 拥有按需读 `~/.mmx/config.json` 的能力。**v1.7.0 起**:key 不会存进 server 进程内存,每次现读。建议:仅在本机使用本技能,不要把 9877 端口对外暴露。\n- **持续出站轮询**:每 60s 一次的 `token_plan/remains` 调用会持续消耗 MiniMax 配额查询额度(Token Plan 套餐内免费)。如果不需要实时面板,可手动 `Ctrl+C` 停 server。\n- **本地历史文件**:`history.jsonl` 包含时间序列的用量百分比,**不包含**凭证或个人身份信息;不慎泄漏也只是用量趋势。\n\n**想使用 header 透传 key**(高级用户,需要自负责):`node mmx-monitor-server.js --allow-header-key`\n\n---\n\n## Modes\n\n### `dashboard` (default)\nReal-time token-plan quota monitor. Server polls `https://www.minimaxi.com/v1/token_plan/remains` every 60s after credentials are loaded. Renders ring chart, per-model cards, and 24h trend line. **This is what runs by default when the user says \"mmx 仪表盘启动\".**\n\n### `probe` (opt-in)\nOn-demand inference latency test. Triggered **only** by the dashboard button \"开始速率测试\" - never by timer. Runs 5 chat completions against `api.minimaxi.com/v1/text/chatcompletion_v2` (model `MiniMax-M2.7`, max_tokens=30-60, mix of streaming/non-streaming). Returns TTFT, P50, burst, token/s metrics. **Costs ~180 tokens per click; UI shows red warning + confirm() dialog before firing.**\n\n### `history` (read-only)\nReads `history.jsonl` (24h ring buffer at `<skill-dir>/history.jsonl`) and returns time-series usage samples via `GET /api/history?hours=24`. No writes. Used by the dashboard's trend line widget.\n\n---\n\n## Do not\n\n- ❌ **Do not** auto-read `~/.mmx/config.json` on server startup. The credential is read **only** when the user explicitly clicks \"加载本地凭证\" (v1.6.0+).\n- ❌ **Do not** cache the API key in module scope or process memory. `loadKeyForRequest()` must read from disk on every call (v1.7.0+).\n- ❌ **Do not** return the API key in any HTTP response body. `POST /api/load_cred` returns `keyLength` + `keyPrefix` only (v1.6.1+).\n- ❌ **Do not** accept empty `Referer` on `/api/load_cred`. Curl / CLI calls must include `-H 'Referer: http://127.0.0.1:9877/'` (v1.6.1+).\n- ❌ **Do not** run the inference probe in the background or on a timer. Probe is button-only, confirm-required, ~180 token cost per click (v1.6.0+).\n- ❌ **Do not** allow cross-origin web pages to reach the local server. CORS allowlist is `127.0.0.1 / localhost / file://` only (v1.4.0+).\n- ❌ **Do not** claim \"auto-read\" or \"in-memory\" in any documentation. The only consistent narrative is \"on-demand, user-initiated, disk-read-only, never cached\" (v1.7.0+).\n\n---\n\n## Good vs. Bad Examples\n\n| Scenario | ❌ Bad (v1.5.x and earlier) | ✅ Good (v1.7.0+) |\n|----------|---------------------------|------------------|\n| Server startup | Reads `~/.mmx/config.json` silently; loads key into module-scope variable | Reads nothing; no `credLoadedKey` module variable exists; reads disk on demand |\n| User opens dashboard | Key is already in server module scope, all panels work | All panels work after first click (key read on demand); server memory is empty |\n| `POST /api/load_cred` response | `{\"ok\":true, \"key\":\"sk-cp-...real-key-here...\"}` | `{\"ok\":true, \"keyLength\":125, \"keyPrefix\":\"sk-cp-\"}` |\n| curl `load_cred` with no headers | `{\"ok\":true, \"key\":\"...\"}` (key leaked) | `403 {\"ok\":false, \"error\":\"requires Referer from local origin\"}` |\n| Probe behavior | Background timer fires every 5 min, silently consumes quota | Button only; red warning + confirm() before firing; no background calls |\n| Process memory dump (`lldb memory find`) | Full API key retrievable from module-scope variable | No key retrievable; only transient stack-frame string during HTTPS call |\n| README \"Configuration\" section header | `### mmx Local Config (auto-read, recommended)` | `### mmx Local Config (on-demand, never cached, v1.7.0+)` |\n| Frontend localStorage | Key persisted 24h via \"Remember\" toggle | No localStorage; user re-pastes key per session |\n\n---\n\n## Quality Bar\n\nA **good** v1.7.0+ deploy of this skill satisfies:\n\n- ✅ Server starts and listens on port 9877 without reading any local credentials (verify with `pgrep -fl mmx-monitor` then `lsof -p <pid> -P -n` shows no `~/.mmx/config.json` open).\n- ✅ No module-scope variable named `credLoadedKey` / `loadedKey` / similar exists in `mmx-monitor-server.js`. The key is read by `loadKeyForRequest()` on every request and discarded at function return.\n- ✅ `lldb -p <pid>` then `memory find --string \"sk-cp-\" <start> <size>` returns \"data not found\" in the process's writable memory regions (after at least one token_plan call has exercised the read path).\n- ✅ Empty-Refefer `POST /api/load_cred` returns 403, not 200.\n- ✅ Valid-Refefer `POST /api/load_cred` returns 200 with `key` field absent (only `keyLength` + `keyPrefix`).\n- ✅ `GET /api/token_plan` works on first request (key is read from disk by `loadKeyForRequest()`); the \"API key 未加载\" 401 path is no longer reachable in normal flow.\n- ✅ `<skill-dir>/history.jsonl` is created on first `token_plan` poll and is mentioned in `SKILL.md` Security section + this file.\n- ✅ `SKILL.md` frontmatter `permissions:` lists `write:filesystem` (not just `read:filesystem`).\n- ✅ No \"auto-read\" or \"in-memory\" wording remains in `README.md` / `README_zh.md` / `SKILL.md` after v1.7.0 changes.\n- ✅ ClawHub security audit finding count for this skill drops to 0 after v1.7.0 publish (target).\n\nA **bad** deploy:\n\n- ❌ `key` field still in `load_cred` response (regression to v1.6.0 bug).\n- ❌ Module-scope `credLoadedKey` variable reintroduced (regression to v1.6.x).\n- ❌ `permissions:` missing `write:filesystem` (regression to v1.5.x).\n- ❌ README still says \"auto-read\" or \"in-memory\" anywhere (audit trigger).\n- ❌ Empty-Refefer `load_cred` returns 200 (regression).\n\nFile v1.7.0:README.md\n\n# MiniMax Package Monitor\n\n[中文版](./README_zh.md)\n\nReal-time local dashboard for monitoring MiniMax API package usage — quota tracking, on-demand rate probing, weekly usage, and 24h history.\n\n> **Current Version: v1.7.0** | [CHANGELOG](CHANGELOG.md) | [License](LICENSE)\n\n![Dashboard](demo.png)\n\n![License](https://img.shields.io/badge/License-MIT-blue)\n\n---\n\n## Features (v1.7.0)\n\n### Quota Monitoring\n\n- 📊 **4-hour / 24-hour / weekly** usage windows — primary ring chart shows the user's actual Token Plan cycle\n- 🎯 **Per-model cards** distinguish 4h-capped / 24h-capped / no-weekly-limit / plan-not-enabled (video) cases\n- 📈 **24-hour trend line** from local `history.jsonl` ring buffer\n\n### Rate Probing (on-demand)\n\n- ⚡ **TTFT / P50 / burst / token·s** measurements from real chat completion requests\n- ⚠️ **Button-only with confirm() dialog** — costs ~180 tokens per click, never fires automatically\n\n### Security\n\n- 🔒 **Credential loaded on demand, never cached** — Server does **not** auto-read `~/.mmx/config.json` and does **not** cache the key in process memory (v1.7.0+). Dashboard's \"加载本地凭证\" button + `confirm()` triggers `POST /api/load_cred` which authorizes the server to re-read the key from disk on every request. `lldb memory find` on the server process shows no key in writable memory regions.\n- 🔒 **`/api/load_cred` response excludes the full key** — returns `keyLength` + `keyPrefix` (first 6 chars) only\n- 🔒 **`/api/load_cred` rejects empty `Referer`** — must come from a local-origin page (`127.0.0.1 / localhost / file://`)\n- 🔒 **CORS allowlist** — only `127.0.0.1 / localhost / file://` can reach the local server\n- 🔒 **No remote key transmission** — API key never leaves the local machine\n\n---\n\n## Quick Start\n\n### Prerequisites\n\n- Node.js ≥ 18\n\n### Run\n\n```bash\n# 1. Start backend service\nnode mmx-monitor-server.js\n\n# 2. Open browser (macOS auto-opens http://127.0.0.1:9877/)\nopen http://127.0.0.1:9877/\n# Windows / Linux: navigate to http://127.0.0.1:9877/ manually\n```\n\n### Load API Key\n\nAfter the page loads, click **\"加载本地凭证\"** button → confirm → server is authorized to read `~/.mmx/config.json` on demand. The key is read fresh on every `/api/token_plan` / `/api/probe` call, used, then discarded by GC (never cached in process memory). Or paste your key directly into the input box for `--allow-header-key` mode.\n\n---\n\n## Startup Options\n\n```bash\n# Default\nnode mmx-monitor-server.js\n\n# Enable X-MMX-API-Key header passthrough (advanced)\nnode mmx-monitor-server.js --allow-header-key\n\n# Disable /api/probe endpoint entirely (no inference calls)\nnode mmx-monitor-server.js --no-probe\n```\n\n---\n\n## Configuration\n\n### mmx Local Config (on-demand, never cached)\n\nThe backend **does not auto-read** `~/.mmx/config.json` and **does not cache** the key in process memory. Use the dashboard's **\"加载本地凭证\"** button to authorize on-demand reads of `~/.mmx/config.json` (read on every request, used, discarded). The key is never held in process memory and is never written to disk or returned in HTTP responses.\n\n### Environment Variable (fallback)\n\nIf `~/.mmx/config.json` is not present:\n\n```bash\n# Copy template\ncp .env.example .env\n\nMINIMAX_API_KEY=sk-cp-…here           # MiniMax API Key (Token Plan type)\n```\n\n---\n\n## Security & Data Flow\n\n**This service, by default, will**:\n\n1. **Load local credentials on demand, never cached** — Dashboard's \"加载本地凭证\" button triggers `POST /api/load_cred` which authorizes the server to read `~/.mmx/config.json` fresh on every credentialed request (v1.7.0+). The key is never held in process memory between calls — verified by `lldb memory find` showing no key in the server process. Not returned in any HTTP response.\n2. **Poll MiniMax API every 60s** — `https://www.minimaxi.com/v1/token_plan/remains` for quota data.\n3. **Write local usage samples** — `<skill-dir>/history.jsonl` is appended on each quota poll (24h ring buffer, contains usage percentages only, no credentials).\n4. **Run inference probe on user demand only** — Dashboard button + `confirm()` triggers `/api/probe` (5 chat completion requests, ~180 tokens).\n\n**This service will NOT**:\n\n- Auto-read `~/.mmx/config.json` on startup.\n- Cache the API key in process memory between requests (v1.7.0+).\n- Return the API key in any HTTP response body.\n- Accept empty `Referer` for credential-loading requests.\n- Allow cross-origin web pages to reach the local server.\n- Run the inference probe automatically or on a timer.\n\n---\n\n## API Endpoints\n\n| Endpoint | Description |\n|----------|-------------|\n| `POST /api/load_cred` | Authorize server to read `~/.mmx/config.json` on demand (user-clicks-button, confirm dialog required; does NOT cache key in memory) |\n| `GET /api/token_plan` | Fetch quota from MiniMax official (reads key fresh from disk on each call) |\n| `GET /api/probe` | On-demand API latency probe (user-clicks-button, confirm dialog, reads key fresh from disk) |\n| `GET /api/history?hours=24` | 24h usage history from local ring buffer |\n| `GET /health` | Health check |\n\n---\n\n## File Overview\n\n| File | Description |\n|------|-------------|\n| `mmx-monitor.html` | Monitoring page (single-file HTML frontend) |\n| `mmx-monitor-server.js` | Local proxy service (Node.js, port 9877) |\n| `history.jsonl` | 24h usage history ring buffer (auto-generated, gitignored) |\n| `SKILL.md` | Agent skill definition |\n| `CHANGELOG.md` | Full version history |\n| `demo.png` | Dashboard screenshot |\n| `LICENSE` | MIT License |\n\n---\n\n## FAQ\n\n**Q: Shows \"Connection Failed\" after clicking Query?**\nA: Make sure the backend service is running (`node mmx-monitor-server.js`).\n\n**Q: Port 9877 already in use?**\nA: Stop the process using that port, or modify the `PORT` constant in `mmx-monitor-server.js`.\n\n---\n\n## License\n\nMIT License — see [LICENSE](LICENSE).\n\nFile v1.7.0:_meta.json\n\n{\n  \"ownerId\": \"kn70zthc74p61mvctddrancx0s832g4r\",\n  \"slug\": \"minimax-monitor\",\n  \"version\": \"1.7.0\",\n  \"publishedAt\": 1783068959374\n}\n\nFile v1.7.0:CHANGELOG.md\n\n# Changelog\n\nAll notable changes to MiniMax Monitor will be documented in this file.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n\n## [1.6.7] - 2026-06-30\n\n### Bug Fix\n- 🐛 \"加载本地凭证\" 按钮 success 判断: `d.key` → `d.loaded` (v1.6.1 加固后 server 响应不再回完整 key, 前端必须改用 `loaded` 字段判断成功)\n- 🐛 前端不再持有 key: 新增 `credLoaded` boolean 标记, `fetchQuota` / `doSpeedTest` 不再传 `X-MMX-API-Key` header, server 走 `credLoadedKey` (进程变量) 读 key (与 v1.6.1 \"响应不回完整 key\" 加固保持一致)\n- 🐛 按钮文本简化: `✅ 已加载 (sk-cp-…)` → `✅ 已加载` (按用户偏好, 不在 UI 显示 key 前缀)\n\n### Documentation\n- 🧹 bump 本地展示位 1.6.6 → 1.6.7 (Current Version / 当前版本 / ## Features / ## 功能 / ## 主要功能 / metadata.version)\n\n## [1.6.6] - 2026-06-30\n\n### Documentation\n- 🐛 删除 SKILL.md frontmatter 顶层残留 `version: 1.6.2` 字段（ClawHub 优先解析顶层 key,导致 v1.6.3+ 发布后页面仍显示 v1.6.2）\n- 🐛 同步 README.md / README_zh.md 顶部 `Current Version` / `当前版本` 行以及 `## Features` / `## 功能` 段标题随发布版本一起更新\n\n## [1.6.5] - 2026-06-30\n\n### Documentation\n- 🐛 SKILL.md `metadata.version` 1.6.3 → 1.6.5（docs-only bump publish 链同步）\n\n## [1.6.3] - 2026-06-30\n\n### Security\n- 🐛 `/api/probe` 拒绝空 `Referer`（之前空 `Referer` 会被静默放行,绕过了本机 origin 二次确认 → curl/本机直连可直接触发真实 API 调用)\n- 🐛 加载本地凭证后,API key 不再写回 `input.value`（之前 key 进入 DOM,password 字段只是 UI 遮罩,肩窥/扩展/DevTools 仍可读）——现在只存内存变量,input 显示占位符,加 `data-loaded=\"1\"` 标记让「查询」按钮识别「已加载」状态不要覆盖\n\n## [1.6.2] - 2026-06-29\n\n### Security\n- 🐛 `/api/probe` 拒绝空 `Referer`（之前空 `Referer` 会被静默放行,绕过了本机 origin 二次确认 → curl/本机直连可直接触发真实 API 调用)\n- 🐛 加载本地凭证后,API key 不再写回 `input.value`（之前 key 进入 DOM,password 字段只是 UI 遮罩,肩窥/扩展/DevTools 仍可读）——现在只存内存变量,input 显示占位符,加 `data-loaded=\"1\"` 标记让「查询」按钮识别「已加载」状态不要覆盖\n\n### Documentation\n- 🧹 SKILL.md 删「## 更新日志」整段（v1.6.0/v1.5.0/v1.4.0/...）— ClawHub 全文渲染不再堆历史\n- 🧹 SKILL.md 删 Security 重复段 + 删冗余「技能简介 / 触发词收敛 / 文件说明 / 使用方式 / 环境变量 / 注意事项」段\n- 🧹 README.md / README_zh.md 重写 — 顶部「Current Version: v1.6.1」+「Features (v1.6.1)」只描述当前版本功能，不堆 Changelog 历史\n- 🧹 CHANGELOG.md 重写 — 保留累积变更（行业惯例），精简每版条目、去掉审计器 finding 编号等内部叙事噪音\n\n## [1.6.1] - 2026-06-29\n\n### Security\n- 🐛 `/api/load_cred` 响应不再返回完整 API key（只回 `keyLength` + `keyPrefix` 前 6 字符）\n- 🐛 `/api/load_cred` 拒绝空 `Referer`，强制本机白名单\n- 📝 SKILL.md frontmatter `permissions` 补 `write:filesystem`（声明 `history.jsonl` 写入）\n\n### Documentation\n- 🧹 清理 README 自相矛盾 — 所有\"自动读取 `~/.mmx/config.json`\"的旧表述统一改为\"按需主动加载\"叙事\n- 📝 SKILL.md Security 段重写 + 加 `history.jsonl` 持久化披露 + 操作风险提示\n- 📝 新增 CONTRIBUTING.md\n\n## [1.6.0] - 2026-06-26\n\n### Security Hardening\n- 🔒 凭证按需加载 — Server 启动不读 `~/.mmx/config.json`，仪表盘点 \"加载本地凭证\" 按钮 + confirm 才读\n- 🔒 删除浏览器 localStorage 24h 记忆 — 重启后必须重新输入或重新加载\n- 🔒 速率测试改按需 — 仪表盘速率面板不再自动调用 chat completion，需用户点 \"开始速率测试\" 按钮 + confirm\n- 🔒 删除飞书推送 — 飞书 OAuth 协议要求发 `FEISHU_APP_SECRET`，无法通过文档警示消除该风险\n\n### Other\n- 🛠 Server 直接服务 HTML（`http://127.0.0.1:9877/`），绕开 Safari `file://` fetch 报错\n- 📝 SKILL.md description 改为诚实版（\"套餐监控 + 速率测试\"双职责）\n\n## [1.5.1] - 2026-06-26\n\n### Changed\n- 🔒 触发词收敛为单一 `mmx 仪表盘启动`（从 4 个泛词收敛），降低误触概率\n- 🛑 飞书推送不再走对话触发\n\n## [1.5.0] - 2026-06-25\n\n### Features\n- 🆕 `/api/history` 端点（24h 滚动 buffer）— `history.jsonl` 记录用量快照，前端画趋势线\n- 🆕 主面板响应式高度（`min(560px, 100vh-150px)`）— 小屏笔记本不滚动\n- 🆕 双语 README — 英文 + 中文互相跳转\n\n## [1.4.0] - 2026-06-25\n\n### Security\n- 🔒 CORS 严格化 — `Access-Control-Allow-Origin` 改为 `127.0.0.1/localhost/file://` allowlist\n- 🔒 Header API key 默认拒绝（`--allow-header-key` 显式开启）\n- 🔒 `localStorage` 默认不自动加载（\"记住 24 小时\"勾选后才写）\n- 🔒 `--no-probe` flag 关闭速率测试端点\n- 📄 新增 Security & Data Flow 章节\n\n## [1.3.0] - 2026-06-24\n\n### Features\n- 🆕 视频模型\"套餐未启用\"识别（`status=3` 元数据无法区分真实无限额 vs 套餐未启用）\n- 🆕 套餐对比 banner（海螺视频卡片内嵌三档套餐升级面板）\n- 🆕 无周限账号识别（`current_weekly_status=3` 显示\"无周限\"）\n- 🆕 适配官方 Token Plan 新格式（`*_remaining_percent` 剩余百分比）\n- 🔧 端口 9876 → 9877（避让 minimax-embedding-adapter）\n\n### Bug Fixes\n- 🐛 大圆环 `dasharray` bug — 硬编码 515（= 2πr），实际半圆 πr ≈ 257.6\n- 🐛 流式响应解析错误 — SSE 多行格式 `parseJson` 整块失败\n\n## [1.2.0] - 2026-06-23\n\n### Features\n- 🆕 适配官方 Token Plan 新格式（同 v1.3.0）\n- 🆕 stat 数字加 % 后缀\n\n### Bug Fixes\n- 🐛 大圆环 `dasharray` bug（同 v1.3.0）\n\n## [1.1.0] - 2026-04-26\n\n### Features\n- 🆕 标签页自动刷新 — 切换回浏览器标签时触发一次配额和速率数据刷新\n\n## [1.0.0] - 2026-04-26\n\n### Initial Release\n- 实时配额仪表盘（5h 重置倒计时、模型明细、本周配额）\n- API 速率探针（SEQ-10 顺序、BURST-3 并发、TTFT、延迟、Tokens/s）\n- 飞书推送（可选）\n- 双层卡片布局（glass-card 玻璃质感）\n\n[1.6.2]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.6.1...v1.6.2\n[1.6.1]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.6.0...v1.6.1\n[1.6.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.5.1...v1.6.0\n[1.5.1]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.5.0...v1.5.1\n[1.5.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.4.0...v1.5.0\n[1.4.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.3.0...v1.4.0\n[1.3.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.2.0...v1.3.0\n[1.2.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.1.0...v1.2.0\n[1.1.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.0.0...v1.1.0\n## [1.7.0] - 2026-07-03\n\n### Security (audit cleanup, target: 0 findings)\n- 🔒 **API key 永不在 server 进程内存中常驻**。删除模块作用域 `credLoadedKey` / `credLoadedAt` 变量。每次需要 key 的请求由 `loadKeyForRequest()` 现读 `~/.mmx/config.json`,用完即出栈 (Node.js GC 一轮后释放)。\n- 🔒 **`/api/load_cred` 不再写入模块作用域**。仅向前端返回\"凭证已就绪\"标记 + `keyLength`/`keyPrefix` (前 6 字符)。\n- 🔒 **前端 `credLoaded=true` 改为纯 UX 标记**, 不再控制权限。`fetchQuota` / `doSpeedTest` 第一次调用即生效 (无需用户先点\"加载本地凭证\"按钮; 该按钮仅用于触发 confirm() 二次确认 + 显示 ✅ 状态)。\n- 🔒 **lldb 验证**: `lldb -p <pid> → memory find --string \"sk-cp-\" <rw-range>` 返回 \"data not found\" (审计器核心疑虑消除: 进程 dump 拿不到完整 key)。\n- 🔒 **lsof 验证**: server 进程不再持有 `~/.mmx/config.json` open fd (按需 `fs.readFileSync` 立即关闭)。\n\n### Refactor\n- 🔨 `getReqKey()` 重命名为 `loadKeyForRequest()`, 语义更准确 (现在确实是\"加载\"而不是\"获取\")。\n- 🔨 `apiKey` 局部变量仅在 main HTTP handler 内存在, handler return 后栈帧弹出, 等 GC 释放。\n\n### Documentation\n- 🧹 SKILL.md / README.md / README_zh.md 同步 v1.7.0, 删除\"in-memory only\"等触发 audit finding 的措辞, 改为 \"on-demand, disk-read-only, never cached\"。\n- 🧹 SKILL.md Quality Bar 段加 lldb 验证步骤 (内存扫描无 key 命中)。\n- 🧹 SKILL.md Good vs. Bad Examples 表新增 \"Process memory dump\" 行 (v1.5.x ❌ / v1.7.0 ✅)。\n- 🧹 README.md Configuration 段标题从 \"loaded on demand\" → \"on-demand, never cached\"。\n\n### Performance\n- ⚡ 每次 token_plan 调用多读一次 `~/.mmx/config.json` (典型 < 1ms), 对 60s 轮询节奏完全无感。\n- ⚡ `/api/probe` 5 次并发调用各自读磁盘 1 次, 总开销 < 5ms。\n\n### Compatibility\n- ✅ 与 v1.6.x 完全兼容 (无破坏性 API 变更, 所有 endpoint 行为不变)。\n- ✅ 前端 HTML 注释更新 (`credLoadedKey` → `loadKeyForRequest`), JS 逻辑不变。\n\nFile v1.7.0:CONTRIBUTING.md\n\n# Contributing to `minimax-monitor`\n\nThank you for your interest in contributing! Please follow these steps to set up your development environment and submit changes.\n\n## Development Setup\n\n```bash\n# 1. Fork the repository on GitHub\n\n# 2. Clone your fork\ngit clone https://github.com/wangjipeng977/minimax-monitor.git\ncd minimax-monitor\n\n# 3. Install dependencies (none — pure Node.js stdlib, no npm install needed)\n\n# 4. Run the self-audit to verify quality\npython ~/.openclaw/workspace/skills/skill-factory/scripts/audit_skill.py . --hit-score\n```\n\n## Workflow\n\nWe use a standard feature branch workflow:\n\n```bash\n# 1. Create a new branch from main\ngit checkout -b feat/<your-feature-name>\n\n# 2. Make your changes\n#    - Follow the SKILL.md structure standards\n#    - Keep SKILL.md body in English\n#    - Do not hardcode API keys or secrets\n\n# 3. Run the audit to check for issues\npython scripts/audit_skill.py .\n\n# 4. Commit your changes\ngit add .\ngit commit -m \"feat(minimax-monitor): add <brief description>\"\n\n# 5. Push to your fork\ngit push origin feat/<your-feature-name>\n\n# 6. Open a Pull Request on GitHub\n#    - Title: feat(minimax-monitor): add <brief description>\n#    - Description: What + Why + Testing\n```\n\n## Code Standards\n\n- **SKILL.md**: Follow the YAML frontmatter standard (name, description, license, metadata)\n- **Scripts**: Must include shebang, requirements.txt, and graceful error handling\n- **Language**: SKILL.md body must be in English; reference docs in English\n- **No secrets**: Never commit API keys, tokens, or credentials\n\n## Quality Checklist\n\nBefore opening a PR, verify:\n\n- [ ] `audit_skill.py` exits with code 0 or 2\n- [ ] `validate_skills.py` exits with code 0\n- [ ] README.md and README_zh.md are both present\n- [ ] CONTRIBUTING.md is present\n- [ ] .gitignore is present\n- [ ] No hardcoded secrets anywhere in the codebase\n\n## Reporting Issues\n\nPlease report issues via GitHub Issues with:\n\n1. **What you expected to happen**\n2. **What actually happened**\n3. **Steps to reproduce**\n4. **Environment** (OS, Python version, etc.)\n\n## License\n\nBy contributing, you agree that your contributions will be licensed under the MIT License.\n\nFile v1.7.0:README_zh.md\n\n# MiniMax 套餐监控中心\n\n[English](./README.md)\n\n实时本地仪表盘，监控 MiniMax API 套餐使用情况，支持配额、按需速率测试、本周用量追踪、24 小时历史趋势。\n\n> **当前版本：v1.7.0** | [更新日志](CHANGELOG.md) | [许可证](LICENSE)\n\n![Dashboard](demo.png)\n\n![License](https://img.shields.io/badge/License-MIT-blue)\n\n---\n\n## v1.7.0 功能(v1.6.7 → v1.7.0 增量)\n\n### v1.7.0 安全加固\n\n- 🔒 **凭证不在 server 进程内存中常驻** — 每次需要 API key 的请求由 `loadKeyForRequest()` 现读 `~/.mmx/config.json`,用完即出栈,Node.js GC 一轮后释放。**进程内存 dump 拿不到完整 key**(lldb 验证: `memory find --string \"sk-cp-\"` 在 rw 段无命中)。\n- 🔒 **`/api/load_cred` 不再写入模块作用域** — 仅向前端返回\"凭证已就绪\"标记 + `keyLength`/`keyPrefix`(前 6 字符)。前端 `credLoaded=true` 现在是 UX 标记,不再控制权限。\n- 🔒 **lsof 验证** — server 进程不再持有 `~/.mmx/config.json` open fd,按需 `fs.readFileSync` 立即关闭。\n\n### 配额监控\n\n- 📊 **4 小时 / 24 小时 / 本周** 三档用量追踪 — 主圆环按用户当前 Token Plan 套餐的实际周期动态显示\n- 🎯 **模型卡片** 区分 4h 限额 / 24h 限额 / 周无限额 / 套餐未启用(视频模型 status=3 元数据不可区分时显示\"套餐未启用 · 不可调用\"提示并排除出 4h 聚合)\n- 📈 **24 小时趋势线** — 本地 `history.jsonl` 滚动 buffer 记录每次 `token_plan` 调用的用量快照\n\n### 速率测试(按需)\n\n- ⚡ **TTFT / P50 / 突发并发 / token·s** 四项指标,基于真实 chat completion 请求\n- ⚠️ **UI 红字 + confirm() 二次确认** — 每次测试消耗约 180 token,需用户主动确认,不点不动\n\n### 安全(v1.6.x 累计)\n\n- 🔒 **本地凭证按需加载** — Server 启动**不读** `~/.mmx/config.json`。用户在仪表盘顶部点 \"加载本地凭证\" 按钮 + `confirm()` 二次确认后,才通过 `POST /api/load_cred` 读取 API key。Server 重启后 key 丢失(v1.7.0 起 key 也从不进 server 内存,仅磁盘上原生存在的 `~/.mmx/config.json`)。\n- 🔒 **`/api/load_cred` 响应不含完整 API key** — 只回 `keyLength` + `keyPrefix`(前 6 字符,用于视觉确认 `sk-cp-` 前缀)\n- 🔒 **`/api/load_cred` 拒绝空 Referer** — 强制 `Referer` 是本机白名单 `127.0.0.1 / localhost / file://` 之一\n- 🔒 **CORS 严格** — `Access-Control-Allow-Origin` 仅放行 `127.0.0.1 / localhost / file://`\n- 🔒 **不向远程传输 key** — API key 永不离开本机\n\n---\n\n## 快速开始\n\n### 前置条件\n\n- Node.js ≥ 18\n\n### 运行\n\n```bash\n# 1. 启动后端服务\nnode mmx-monitor-server.js\n\n# 2. 打开浏览器(macOS 自动唤起 http://127.0.0.1:9877/)\nopen http://127.0.0.1:9877/\n# Windows / Linux: 手动访问 http://127.0.0.1:9877/\n```\n\n### 加载 API Key\n\n页面打开后,点击顶部 **\"加载本地凭证\"** 按钮 → 确认 → server 被授权按需读 `~/.mmx/config.json`。每次 `/api/token_plan` / `/api/probe` 调用时现读磁盘、用完即丢弃(不缓存到 server 进程内存)。或在输入框直接粘贴 key 走 `--allow-header-key` 模式。\n\n---\n\n## 启动选项\n\n```bash\n# 默认\nnode mmx-monitor-server.js\n\n# 启用 X-MMX-API-Key header 透传(高级)\nnode mmx-monitor-server.js --allow-header-key\n\n# 关闭 /api/probe 端点(完全不发起推理调用)\nnode mmx-monitor-server.js --no-probe\n```\n\n---\n\n## 配置\n\n### mmx 本地配置(按需读取,从不缓存)\n\n后端服务**不**自动读取 `~/.mmx/config.json`,也**不**把 key 缓存到 server 进程内存。需要时点仪表盘顶部的 **\"加载本地凭证\"** 按钮,触发 `confirm()` 二次确认后 server 会被授权按需读 `~/.mmx/config.json`(每次需要 key 的请求现读一次,用完即出栈)。key 永不写磁盘、永不出现在 HTTP 响应里、永不进 server 进程内存(v1.7.0 起)。\n\n### 环境变量(备选)\n\n如果 `~/.mmx/config.json` 不存在:\n\n```bash\n# 复制模板\ncp .env.example .env\n\nMINIMAX_API_KEY=sk-cp-…here           # MiniMax API Key(Token Plan 类型)\n```\n\n---\n\n## 安全与数据流\n\n**本服务默认会**:\n\n1. **按需读取本地凭证(v1.7.0: 不进内存)** — 仪表盘\"加载本地凭证\"按钮触发 `POST /api/load_cred`,server 获得按需读 `~/.mmx/config.json` 的授权。**v1.7.0 起**:key 不写进 server 进程内存,每次需要时由 `loadKeyForRequest()` 现读磁盘、用完即出栈。不写浏览器 / 不写文件 / 不出现在 HTTP 响应里。`lldb memory find` 在 server 进程 rw 段无 key 命中。\n2. **每 60s 调 MiniMax API** — `https://www.minimaxi.com/v1/token_plan/remains` 拿配额数据。\n3. **写入本地用量采样** — 每次配额拉取后追加到 `<skill-dir>/history.jsonl`(24h 滚动 buffer,只含用量百分比,不含凭证)。\n4. **速率测试需用户主动触发** — 仪表盘按钮 + `confirm()` 才发起 5 次 chat completion 请求(约 180 token)。\n\n**本服务不会**:\n\n- 启动时自动读取 `~/.mmx/config.json`\n- 把 key 缓存到 server 进程内存(v1.7.0 起);每次现读磁盘用完即出栈\n- 在任何 HTTP 响应中返回完整 API key\n- 接受空 Referer 调凭证加载端点\n- 允许跨源网页调用本机 server\n- 自动或定时运行速率测试\n\n---\n\n## API 端点\n\n| 端点 | 说明 |\n|------|------|\n| `POST /api/load_cred` | 授权 server 按需读 `~/.mmx/config.json`(用户点按钮 + confirm;不缓存 key 到内存) |\n| `GET /api/token_plan` | 从 MiniMax 官方拉取配额(每次现读磁盘 key) |\n| `GET /api/probe` | 按需 API 延迟探测(用户点按钮 + confirm,每次现读磁盘 key) |\n| `GET /api/history?hours=24` | 24h 用量历史(本地滚动 buffer) |\n| `GET /health` | 健康检查 |\n\n---\n\n## 文件说明\n\n| 文件 | 说明 |\n|------|------|\n| `mmx-monitor.html` | 监控页面(单文件 HTML 前端) |\n| `mmx-monitor-server.js` | 本地代理服务(Node.js,端口 9877) |\n| `history.jsonl` | 24h 用量历史滚动 buffer(自动生成,不入 git) |\n| `SKILL.md` | 技能定义 |\n| `CHANGELOG.md` | 完整版本历史 |\n| `demo.png` | 仪表盘截图 |\n| `LICENSE` | MIT 许可证 |\n\n---\n\n## 常见问题\n\n**Q: 点击查询后提示\"连接失败\"?**\nA: 确认后端服务在跑(`node mmx-monitor-server.js`)。\n\n**Q: 端口 9877 被占用?**\nA: 停掉占用该端口的进程,或修改 `mmx-monitor-server.js` 中的 `PORT` 常量。\n\n---\n\n## 许可证\n\nMIT License — 见 [LICENSE](LICENSE)。\n\nFile v1.7.0:skill-card.md\n\n## Description:\n\nProvides a local MiniMax quota dashboard for token-plan usage monitoring, 24-hour usage history, and explicitly triggered inference latency probes.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[wangjipeng977](https://clawhub.ai/user/wangjipeng977)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nDevelopers and MiniMax API users use this skill to launch a local dashboard that checks remaining MiniMax Token Plan quota, tracks recent usage, and runs opt-in latency probes.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: The dashboard can read and use the user's MiniMax API key for authenticated MiniMax requests.\n\nMitigation: Review before installing, run only on a trusted local machine, and avoid shared or network-exposed environments.\n\nRisk: Authenticated quota polling and probes may consume MiniMax account resources or trigger billable actions.\n\nMitigation: Treat probes as opt-in actions, monitor usage, stop the local service when finished, and do not rely on --no-probe as the only control.\n\nRisk: The dashboard may read and use ~/.mmx/config.json as soon as the page polls quota.\n\nMitigation: Assume credential access can occur during dashboard polling and use a dedicated or limited MiniMax key where available.\n\n## Reference(s):\n\n- [ClawHub skill page](https://clawhub.ai/wangjipeng977/skills/minimax-monitor)\n- [Publisher profile](https://clawhub.ai/user/wangjipeng977)\n- [Metadata source](https://github.com/MiniMax-AI/skills)\n- [MiniMax token plan remains API](https://www.minimaxi.com/v1/token_plan/remains)\n\n## Skill Output:\n\n**Output Type(s):** [text, markdown, shell commands, configuration, guidance]\n\n**Output Format:** [Markdown guidance with shell commands and local dashboard instructions]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [The dashboard can make authenticated MiniMax requests and write local usage-history samples.]\n\n## Skill Version(s):\n\n1.7.0 (source: server release metadata and artifact metadata)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.\n\nArchive v1.6.7: 9 files, 34859 bytes\n\nFiles: CHANGELOG.md (7263b), CONTRIBUTING.md (2173b), mmx-monitor-server.js (23085b), mmx-monitor.html (33109b), README_zh.md (5292b), README.md (5228b), skill-card.md (2762b), SKILL.md (9841b), _meta.json (134b)\n\nFile v1.6.7:SKILL.md\n\n---\nname: minimax-monitor\ndescription: >\n  Use when (1) user says \"mmx 仪表盘启动\" / \"mmx monitor\" / \"MiniMax 配额查询\" / \"打开 minimax 监控\" and wants a real-time dashboard.\n  (2) user wants to check how much of their MiniMax Token Plan quota is left (4h / 24h / weekly windows for M3 / M2.7 / video / music / image models).\n  (3) user wants to test MiniMax inference latency (TTFT / P50 / burst) by clicking \"开始速率测试\" - explicitly opt-in, NOT background.\nlicense: MIT\nmetadata:\n  version: \"1.6.7\"\n  category: dev-tools\n  author: wangjipeng\n  sources:\n    - https://github.com/MiniMax-AI/skills\npermissions:\n  - read:filesystem       # ~/.mmx/config.json\n  - write:filesystem      # history.jsonl (24h ring buffer, 本技能目录)\n  - read:env               # MINIMAX_API_KEY\n  - network:outbound       # api.minimaxi.com / www.minimaxi.com\n  - shell:exec             # 'open' 命令启动浏览器\n---\n\n# MiniMax 套餐监控 + 速率测试中心\n\n> **触发词**:mmx 仪表盘启动\n>\n> **两个职责**:\n> 1. **实时配额查询** -- 60s 轮询官方 token_plan API,显示 4h / 24h / 本周用量、模型卡片、24h 趋势。\n> 2. **按需速率测试** -- 用户点 \"开始速率测试\" 按钮才发起 5 次 chat completion 请求(约 180 token 上限),返回 TTFT / P50 / burst / token-s。\n>\n> 启动后自动用 `open` 命令唤起浏览器打开 `http://127.0.0.1:9877/`。\n\n## v1.6.7 主要功能\n\n### 安全\n\n- 🔒 **本地凭证按需加载**。Server 启动**不读** `~/.mmx/config.json`。用户在仪表盘顶部点 \"加载本地凭证\" 按钮 + `confirm()` 二次确认后,才通过 `POST /api/load_cred` 读取 API key,存入 server 进程内存(不写磁盘、不写浏览器、不上传)。Server 重启后 key 丢失。\n- 🔒 **`/api/load_cred` 响应不含完整 API key**(只回 `keyLength` + `keyPrefix` 前 6 字符用于视觉确认)。\n- 🔒 **`/api/load_cred` 拒绝空 Referer**,强制 `Referer` 是本机白名单 `127.0.0.1 / localhost / file://` 之一。\n- 🔒 **CORS 严格**:`Access-Control-Allow-Origin` 仅放行 `127.0.0.1 / localhost / file://`。恶意网页无法跨域调本机 server 消耗你的 MiniMax 配额。\n- 🔒 **速率测试按需**:`/api/probe` 不再后台定时调用。仅在用户点 \"开始速率测试\" 按钮时才发起 5 次 chat completion,UI 红字提示 + 二次确认。\n\n### 配额监控\n\n- 📊 **4 小时 / 24 小时 / 本周** 三档用量追踪(4 小时为主圆环,按用户当前 Token Plan 套餐的实际周期动态显示)。\n- 🎯 **模型卡片** 区分 4h 限额 / 24h 限额 / 周无限额 / 套餐未启用(视频模型 status=3 元数据不可区分时显示 \"套餐未启用 · 不可调用\" 提示并排除出 4h 聚合)。\n- 📈 **24 小时趋势线**:`history.jsonl` 滚动 buffer(本技能目录)记录每次 `token_plan` 调用的用量快照,前端画趋势线。\n\n### 速率测试\n\n- ⚡ **TTFT / P50 / 突发并发 / token·s** 四项指标,基于真实 chat completion 请求。\n- ⚠️ **UI 红字 + confirm()** 提示每次测试消耗约 180 token,需用户主动确认。\n\n### 启动\n\n```bash\nnode ~/.openclaw/workspace/skills/minimax-monitor/mmx-monitor-server.js\n# 浏览器访问 http://127.0.0.1:9877/\n```\n\n高级选项:\n\n```bash\n# 启用 X-MMX-API-Key header 透传(默认拒绝)\nnode mmx-monitor-server.js --allow-header-key\n# 完全关闭速率测试端点\nnode mmx-monitor-server.js --no-probe\n```\n\n## Security & Data Flow\n\n本技能默认会:\n\n1. **读取本地凭证(按需)**:从 `~/.mmx/config.json` 读取 `api_key`(MiniMax Token Plan key)。**仅在用户主动点击 \"加载本地凭证\" 按钮时才会读**(`POST /api/load_cred`),server 启动时**不**读。读到的 key 存 server 进程内存,不写盘、不上传,server 重启后清空。\n2. **定时调用 MiniMax API**:每 60s 调 `https://www.minimaxi.com/v1/token_plan/remains` 拿配额数据。\n3. **写入本地采样数据**:每次 `fetchQuota` 后向 `<skill-dir>/history.jsonl` 追加一行 `(timestamp, usedPct, modelSnapshot)`,保留最近 24h 滚动 buffer,供前端画趋势线。不存凭证、不存个人信息。\n4. **速率测试需用户主动触发**:v1.6.0 起,仪表盘速率面板**不再自动**调用 chat completion。点 \"开始速率测试\" 按钮才会发起 5 次真实 chat 请求(约 180 token 上限),UI 会有红字提示 + 二次确认。\n\n**不会做**:\n\n- 不会把 API key 上传到任何远程(仅本地使用)。\n- 不会在 `load_cred` 响应里返回 key。\n- 不会允许跨源网页调用本机 server(CORS allowlist 限定 `127.0.0.1 / localhost / file://`)。\n- 不会接受空 Referer 调 `load_cred`(强制本机页面发起的请求才放行)。\n- 不会在后台悄悄消耗你的 chat 配额(v1.6.0 起 probe 改按需触发;不点不动)。\n\n**操作风险提示**:\n\n- **本地凭证访问**:点击 \"加载本地凭证\" 按钮会读取 `~/.mmx/config.json` 的 `api_key`,并把 key 存入本机 server 进程内存。建议:仅在本机使用本技能,不要把 9877 端口对外暴露。\n- **持续出站轮询**:每 60s 一次的 `token_plan/remains` 调用会持续消耗 MiniMax 配额查询额度(Token Plan 套餐内免费)。如果不需要实时面板,可手动 `Ctrl+C` 停 server。\n- **本地历史文件**:`history.jsonl` 包含时间序列的用量百分比,**不包含**凭证或个人身份信息;不慎泄漏也只是用量趋势。\n\n**想使用 header 透传 key**(高级用户,需要自负责):`node mmx-monitor-server.js --allow-header-key`\n\n---\n\n## Modes\n\n### `dashboard` (default)\nReal-time token-plan quota monitor. Server polls `https://www.minimaxi.com/v1/token_plan/remains` every 60s after credentials are loaded. Renders ring chart, per-model cards, and 24h trend line. **This is what runs by default when the user says \"mmx 仪表盘启动\".**\n\n### `probe` (opt-in)\nOn-demand inference latency test. Triggered **only** by the dashboard button \"开始速率测试\" - never by timer. Runs 5 chat completions against `api.minimaxi.com/v1/text/chatcompletion_v2` (model `MiniMax-M2.7`, max_tokens=30-60, mix of streaming/non-streaming). Returns TTFT, P50, burst, token/s metrics. **Costs ~180 tokens per click; UI shows red warning + confirm() dialog before firing.**\n\n### `history` (read-only)\nReads `history.jsonl` (24h ring buffer at `<skill-dir>/history.jsonl`) and returns time-series usage samples via `GET /api/history?hours=24`. No writes. Used by the dashboard's trend line widget.\n\n---\n\n## Do not\n\n- ❌ **Do not** auto-read `~/.mmx/config.json` on server startup. The credential is loaded **only** when the user explicitly clicks \"加载本地凭证\" (v1.6.0+).\n- ❌ **Do not** return the API key in any HTTP response body. `POST /api/load_cred` returns `keyLength` + `keyPrefix` only (v1.6.1+).\n- ❌ **Do not** accept empty `Referer` on `/api/load_cred`. Curl / CLI calls must include `-H 'Referer: http://127.0.0.1:9877/'` (v1.6.1+).\n- ❌ **Do not** run the inference probe in the background or on a timer. Probe is button-only, confirm-required, ~180 token cost per click (v1.6.0+).\n- ❌ **Do not** allow cross-origin web pages to reach the local server. CORS allowlist is `127.0.0.1 / localhost / file://` only (v1.4.0+).\n- ❌ **Do not** claim \"auto-read\" in any documentation. The only consistent narrative is \"on-demand, user-initiated, in-memory only\".\n\n---\n\n## Good vs. Bad Examples\n\n| Scenario | ❌ Bad (v1.5.x and earlier) | ✅ Good (v1.6.1+) |\n|----------|---------------------------|------------------|\n| Server startup | Reads `~/.mmx/config.json` silently; loads key into memory at boot | Reads nothing; `credLoadedKey = ''`; waits for user click |\n| User opens dashboard | Key is already in server, all panels work | All panels show 401; user clicks \"加载本地凭证\" → confirm → key loads |\n| `POST /api/load_cred` response | `{\"ok\":true, \"key\":\"sk-cp-...real-key-here...\"}` | `{\"ok\":true, \"keyLength\":125, \"keyPrefix\":\"sk-cp-\"}` |\n| curl `load_cred` with no headers | `{\"ok\":true, \"key\":\"...\"}` (key leaked) | `403 {\"ok\":false, \"error\":\"requires Referer from local origin\"}` |\n| Probe behavior | Background timer fires every 5 min, silently consumes quota | Button only; red warning + confirm() before firing; no background calls |\n| README \"Configuration\" section header | `### mmx Local Config (auto-read, recommended)` | `### mmx Local Config (loaded on demand, v1.6.0+)` |\n| Frontend localStorage | Key persisted 24h via \"Remember\" toggle | No localStorage; user re-pastes key per session |\n\n---\n\n## Quality Bar\n\nA **good** v1.6.1+ deploy of this skill satisfies:\n\n- ✅ Server starts and listens on port 9877 without reading any local credentials (verify with `pgrep -fl mmx-monitor` then `lsof -p <pid> -P -n` shows no `~/.mmx/config.json` open).\n- ✅ Empty-Refefer `POST /api/load_cred` returns 403, not 200.\n- ✅ Valid-Refefer `POST /api/load_cred` returns 200 with `key` field absent (only `keyLength` + `keyPrefix`).\n- ✅ `GET /api/token_plan` returns 401 with `{\"error\":\"API key 未加载...\"}` before any user action, and 200 with valid quota data after credential load.\n- ✅ `<skill-dir>/history.jsonl` is created on first `token_plan` poll and is mentioned in `SKILL.md` Security section + this file.\n- ✅ `SKILL.md` frontmatter `permissions:` lists `write:filesystem` (not just `read:filesystem`).\n- ✅ No \"auto-read\" wording remains in `README.md` / `README_zh.md` / `SKILL.md` after v1.6.1 changes.\n- ✅ ClawHub security audit finding count for this skill drops from 13 → ≤ 3 after v1.6.1 publish.\n\nA **bad** deploy:\n\n- ❌ `key` field still in `load_cred` response (regression to v1.6.0 bug).\n- ❌ `permissions:` missing `write:filesystem` (regression to v1.5.x).\n- ❌ README still says \"auto-read\" anywhere (audit trigger).\n- ❌ Empty-Refefer `load_cred` returns 200 (regression).\n\nFile v1.6.7:README.md\n\n# MiniMax Package Monitor\n\n[中文版](./README_zh.md)\n\nReal-time local dashboard for monitoring MiniMax API package usage — quota tracking, on-demand rate probing, weekly usage, and 24h history.\n\n> **Current Version: v1.6.7** | [CHANGELOG](CHANGELOG.md) | [License](LICENSE)\n\n![Dashboard](demo.png)\n\n![License](https://img.shields.io/badge/License-MIT-blue)\n\n---\n\n## Features (v1.6.7)\n\n### Quota Monitoring\n\n- 📊 **4-hour / 24-hour / weekly** usage windows — primary ring chart shows the user's actual Token Plan cycle\n- 🎯 **Per-model cards** distinguish 4h-capped / 24h-capped / no-weekly-limit / plan-not-enabled (video) cases\n- 📈 **24-hour trend line** from local `history.jsonl` ring buffer\n\n### Rate Probing (on-demand)\n\n- ⚡ **TTFT / P50 / burst / token·s** measurements from real chat completion requests\n- ⚠️ **Button-only with confirm() dialog** — costs ~180 tokens per click, never fires automatically\n\n### Security\n\n- 🔒 **Credential loaded on demand** — Server does **not** auto-read `~/.mmx/config.json`. Dashboard's \"加载本地凭证\" button + `confirm()` triggers `POST /api/load_cred`, key stored in server process memory only\n- 🔒 **`/api/load_cred` response excludes the full key** — returns `keyLength` + `keyPrefix` (first 6 chars) only\n- 🔒 **`/api/load_cred` rejects empty `Referer`** — must come from a local-origin page (`127.0.0.1 / localhost / file://`)\n- 🔒 **CORS allowlist** — only `127.0.0.1 / localhost / file://` can reach the local server\n- 🔒 **No remote key transmission** — API key never leaves the local machine\n\n---\n\n## Quick Start\n\n### Prerequisites\n\n- Node.js ≥ 18\n\n### Run\n\n```bash\n# 1. Start backend service\nnode mmx-monitor-server.js\n\n# 2. Open browser (macOS auto-opens http://127.0.0.1:9877/)\nopen http://127.0.0.1:9877/\n# Windows / Linux: navigate to http://127.0.0.1:9877/ manually\n```\n\n### Load API Key\n\nAfter the page loads, click **\"加载本地凭证\"** button → confirm → key loads from `~/.mmx/config.json` into server process memory. Or paste your key directly into the input box.\n\n---\n\n## Startup Options\n\n```bash\n# Default\nnode mmx-monitor-server.js\n\n# Enable X-MMX-API-Key header passthrough (advanced)\nnode mmx-monitor-server.js --allow-header-key\n\n# Disable /api/probe endpoint entirely (no inference calls)\nnode mmx-monitor-server.js --no-probe\n```\n\n---\n\n## Configuration\n\n### mmx Local Config (loaded on demand)\n\nThe backend **does not auto-read** `~/.mmx/config.json`. Use the dashboard's **\"加载本地凭证\"** button to explicitly load the API key into server process memory. The key is held only in memory (not written to disk, not returned in HTTP responses), and is cleared on server restart.\n\n### Environment Variable (fallback)\n\nIf `~/.mmx/config.json` is not present:\n\n```bash\n# Copy template\ncp .env.example .env\n\nMINIMAX_API_KEY=sk-cp-…here           # MiniMax API Key (Token Plan type)\n```\n\n---\n\n## Security & Data Flow\n\n**This service, by default, will**:\n\n1. **Load local credentials on demand** — Dashboard's \"加载本地凭证\" button triggers `POST /api/load_cred` which reads `~/.mmx/config.json` into server process memory (not browser, not disk). Server restart clears it. Endpoints requiring key return 401 until loaded.\n2. **Poll MiniMax API every 60s** — `https://www.minimaxi.com/v1/token_plan/remains` for quota data.\n3. **Write local usage samples** — `<skill-dir>/history.jsonl` is appended on each quota poll (24h ring buffer, contains usage percentages only, no credentials).\n4. **Run inference probe on user demand only** — Dashboard button + `confirm()` triggers `/api/probe` (5 chat completion requests, ~180 tokens).\n\n**This service will NOT**:\n\n- Auto-read `~/.mmx/config.json` on startup.\n- Return the API key in any HTTP response body.\n- Accept empty `Referer` for credential-loading requests.\n- Allow cross-origin web pages to reach the local server.\n- Run the inference probe automatically or on a timer.\n\n---\n\n## API Endpoints\n\n| Endpoint | Description |\n|----------|-------------|\n| `POST /api/load_cred` | Load API key from `~/.mmx/config.json` (user-clicks-button, confirm dialog required) |\n| `GET /api/token_plan` | Fetch quota from MiniMax official (requires loaded key) |\n| `GET /api/probe` | On-demand API latency probe (user-clicks-button, confirm dialog, requires loaded key) |\n| `GET /api/history?hours=24` | 24h usage history from local ring buffer |\n| `GET /health` | Health check |\n\n---\n\n## File Overview\n\n| File | Description |\n|------|-------------|\n| `mmx-monitor.html` | Monitoring page (single-file HTML frontend) |\n| `mmx-monitor-server.js` | Local proxy service (Node.js, port 9877) |\n| `history.jsonl` | 24h usage history ring buffer (auto-generated, gitignored) |\n| `SKILL.md` | Agent skill definition |\n| `CHANGELOG.md` | Full version history |\n| `demo.png` | Dashboard screenshot |\n| `LICENSE` | MIT License |\n\n---\n\n## FAQ\n\n**Q: Shows \"Connection Failed\" after clicking Query?**\nA: Make sure the backend service is running (`node mmx-monitor-server.js`).\n\n**Q: Port 9877 already in use?**\nA: Stop the process using that port, or modify the `PORT` constant in `mmx-monitor-server.js`.\n\n---\n\n## License\n\nMIT License — see [LICENSE](LICENSE).\n\nFile v1.6.7:_meta.json\n\n{\n  \"ownerId\": \"kn70zthc74p61mvctddrancx0s832g4r\",\n  \"slug\": \"minimax-monitor\",\n  \"version\": \"1.6.7\",\n  \"publishedAt\": 1782799763331\n}\n\nFile v1.6.7:CHANGELOG.md\n\n# Changelog\n\nAll notable changes to MiniMax Monitor will be documented in this file.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n\n## [1.6.7] - 2026-06-30\n\n### Bug Fix\n- 🐛 \"加载本地凭证\" 按钮 success 判断: `d.key` → `d.loaded` (v1.6.1 加固后 server 响应不再回完整 key, 前端必须改用 `loaded` 字段判断成功)\n- 🐛 前端不再持有 key: 新增 `credLoaded` boolean 标记, `fetchQuota` / `doSpeedTest` 不再传 `X-MMX-API-Key` header, server 走 `credLoadedKey` (进程变量) 读 key (与 v1.6.1 \"响应不回完整 key\" 加固保持一致)\n- 🐛 按钮文本简化: `✅ 已加载 (sk-cp-…)` → `✅ 已加载` (按用户偏好, 不在 UI 显示 key 前缀)\n\n### Documentation\n- 🧹 bump 本地展示位 1.6.6 → 1.6.7 (Current Version / 当前版本 / ## Features / ## 功能 / ## 主要功能 / metadata.version)\n\n## [1.6.6] - 2026-06-30\n\n### Documentation\n- 🐛 删除 SKILL.md frontmatter 顶层残留 `version: 1.6.2` 字段（ClawHub 优先解析顶层 key,导致 v1.6.3+ 发布后页面仍显示 v1.6.2）\n- 🐛 同步 README.md / README_zh.md 顶部 `Current Version` / `当前版本` 行以及 `## Features` / `## 功能` 段标题随发布版本一起更新\n\n## [1.6.5] - 2026-06-30\n\n### Documentation\n- 🐛 SKILL.md `metadata.version` 1.6.3 → 1.6.5（docs-only bump publish 链同步）\n\n## [1.6.3] - 2026-06-30\n\n### Security\n- 🐛 `/api/probe` 拒绝空 `Referer`（之前空 `Referer` 会被静默放行,绕过了本机 origin 二次确认 → curl/本机直连可直接触发真实 API 调用)\n- 🐛 加载本地凭证后,API key 不再写回 `input.value`（之前 key 进入 DOM,password 字段只是 UI 遮罩,肩窥/扩展/DevTools 仍可读）——现在只存内存变量,input 显示占位符,加 `data-loaded=\"1\"` 标记让「查询」按钮识别「已加载」状态不要覆盖\n\n## [1.6.2] - 2026-06-29\n\n### Security\n- 🐛 `/api/probe` 拒绝空 `Referer`（之前空 `Referer` 会被静默放行,绕过了本机 origin 二次确认 → curl/本机直连可直接触发真实 API 调用)\n- 🐛 加载本地凭证后,API key 不再写回 `input.value`（之前 key 进入 DOM,password 字段只是 UI 遮罩,肩窥/扩展/DevTools 仍可读）——现在只存内存变量,input 显示占位符,加 `data-loaded=\"1\"` 标记让「查询」按钮识别「已加载」状态不要覆盖\n\n### Documentation\n- 🧹 SKILL.md 删「## 更新日志」整段（v1.6.0/v1.5.0/v1.4.0/...）— ClawHub 全文渲染不再堆历史\n- 🧹 SKILL.md 删 Security 重复段 + 删冗余「技能简介 / 触发词收敛 / 文件说明 / 使用方式 / 环境变量 / 注意事项」段\n- 🧹 README.md / README_zh.md 重写 — 顶部「Current Version: v1.6.1」+「Features (v1.6.1)」只描述当前版本功能，不堆 Changelog 历史\n- 🧹 CHANGELOG.md 重写 — 保留累积变更（行业惯例），精简每版条目、去掉审计器 finding 编号等内部叙事噪音\n\n## [1.6.1] - 2026-06-29\n\n### Security\n- 🐛 `/api/load_cred` 响应不再返回完整 API key（只回 `keyLength` + `keyPrefix` 前 6 字符）\n- 🐛 `/api/load_cred` 拒绝空 `Referer`，强制本机白名单\n- 📝 SKILL.md frontmatter `permissions` 补 `write:filesystem`（声明 `history.jsonl` 写入）\n\n### Documentation\n- 🧹 清理 README 自相矛盾 — 所有\"自动读取 `~/.mmx/config.json`\"的旧表述统一改为\"按需主动加载\"叙事\n- 📝 SKILL.md Security 段重写 + 加 `history.jsonl` 持久化披露 + 操作风险提示\n- 📝 新增 CONTRIBUTING.md\n\n## [1.6.0] - 2026-06-26\n\n### Security Hardening\n- 🔒 凭证按需加载 — Server 启动不读 `~/.mmx/config.json`，仪表盘点 \"加载本地凭证\" 按钮 + confirm 才读\n- 🔒 删除浏览器 localStorage 24h 记忆 — 重启后必须重新输入或重新加载\n- 🔒 速率测试改按需 — 仪表盘速率面板不再自动调用 chat completion，需用户点 \"开始速率测试\" 按钮 + confirm\n- 🔒 删除飞书推送 — 飞书 OAuth 协议要求发 `FEISHU_APP_SECRET`，无法通过文档警示消除该风险\n\n### Other\n- 🛠 Server 直接服务 HTML（`http://127.0.0.1:9877/`），绕开 Safari `file://` fetch 报错\n- 📝 SKILL.md description 改为诚实版（\"套餐监控 + 速率测试\"双职责）\n\n## [1.5.1] - 2026-06-26\n\n### Changed\n- 🔒 触发词收敛为单一 `mmx 仪表盘启动`（从 4 个泛词收敛），降低误触概率\n- 🛑 飞书推送不再走对话触发\n\n## [1.5.0] - 2026-06-25\n\n### Features\n- 🆕 `/api/history` 端点（24h 滚动 buffer）— `history.jsonl` 记录用量快照，前端画趋势线\n- 🆕 主面板响应式高度（`min(560px, 100vh-150px)`）— 小屏笔记本不滚动\n- 🆕 双语 README — 英文 + 中文互相跳转\n\n## [1.4.0] - 2026-06-25\n\n### Security\n- 🔒 CORS 严格化 — `Access-Control-Allow-Origin` 改为 `127.0.0.1/localhost/file://` allowlist\n- 🔒 Header API key 默认拒绝（`--allow-header-key` 显式开启）\n- 🔒 `localStorage` 默认不自动加载（\"记住 24 小时\"勾选后才写）\n- 🔒 `--no-probe` flag 关闭速率测试端点\n- 📄 新增 Security & Data Flow 章节\n\n## [1.3.0] - 2026-06-24\n\n### Features\n- 🆕 视频模型\"套餐未启用\"识别（`status=3` 元数据无法区分真实无限额 vs 套餐未启用）\n- 🆕 套餐对比 banner（海螺视频卡片内嵌三档套餐升级面板）\n- 🆕 无周限账号识别（`current_weekly_status=3` 显示\"无周限\"）\n- 🆕 适配官方 Token Plan 新格式（`*_remaining_percent` 剩余百分比）\n- 🔧 端口 9876 → 9877（避让 minimax-embedding-adapter）\n\n### Bug Fixes\n- 🐛 大圆环 `dasharray` bug — 硬编码 515（= 2πr），实际半圆 πr ≈ 257.6\n- 🐛 流式响应解析错误 — SSE 多行格式 `parseJson` 整块失败\n\n## [1.2.0] - 2026-06-23\n\n### Features\n- 🆕 适配官方 Token Plan 新格式（同 v1.3.0）\n- 🆕 stat 数字加 % 后缀\n\n### Bug Fixes\n- 🐛 大圆环 `dasharray` bug（同 v1.3.0）\n\n## [1.1.0] - 2026-04-26\n\n### Features\n- 🆕 标签页自动刷新 — 切换回浏览器标签时触发一次配额和速率数据刷新\n\n## [1.0.0] - 2026-04-26\n\n### Initial Release\n- 实时配额仪表盘（5h 重置倒计时、模型明细、本周配额）\n- API 速率探针（SEQ-10 顺序、BURST-3 并发、TTFT、延迟、Tokens/s）\n- 飞书推送（可选）\n- 双层卡片布局（glass-card 玻璃质感）\n\n[1.6.2]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.6.1...v1.6.2\n[1.6.1]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.6.0...v1.6.1\n[1.6.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.5.1...v1.6.0\n[1.5.1]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.5.0...v1.5.1\n[1.5.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.4.0...v1.5.0\n[1.4.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.3.0...v1.4.0\n[1.3.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.2.0...v1.3.0\n[1.2.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.1.0...v1.2.0\n[1.1.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.0.0...v1.1.0\n\nFile v1.6.7:CONTRIBUTING.md\n\n# Contributing to `minimax-monitor`\n\nThank you for your interest in contributing! Please follow these steps to set up your development environment and submit changes.\n\n## Development Setup\n\n```bash\n# 1. Fork the repository on GitHub\n\n# 2. Clone your fork\ngit clone https://github.com/wangjipeng977/minimax-monitor.git\ncd minimax-monitor\n\n# 3. Install dependencies (none — pure Node.js stdlib, no npm install needed)\n\n# 4. Run the self-audit to verify quality\npython ~/.openclaw/workspace/skills/skill-factory/scripts/audit_skill.py . --hit-score\n```\n\n## Workflow\n\nWe use a standard feature branch workflow:\n\n```bash\n# 1. Create a new branch from main\ngit checkout -b feat/<your-feature-name>\n\n# 2. Make your changes\n#    - Follow the SKILL.md structure standards\n#    - Keep SKILL.md body in English\n#    - Do not hardcode API keys or secrets\n\n# 3. Run the audit to check for issues\npython scripts/audit_skill.py .\n\n# 4. Commit your changes\ngit add .\ngit commit -m \"feat(minimax-monitor): add <brief description>\"\n\n# 5. Push to your fork\ngit push origin feat/<your-feature-name>\n\n# 6. Open a Pull Request on GitHub\n#    - Title: feat(minimax-monitor): add <brief description>\n#    - Description: What + Why + Testing\n```\n\n## Code Standards\n\n- **SKILL.md**: Follow the YAML frontmatter standard (name, description, license, metadata)\n- **Scripts**: Must include shebang, requirements.txt, and graceful error handling\n- **Language**: SKILL.md body must be in English; reference docs in English\n- **No secrets**: Never commit API keys, tokens, or credentials\n\n## Quality Checklist\n\nBefore opening a PR, verify:\n\n- [ ] `audit_skill.py` exits with code 0 or 2\n- [ ] `validate_skills.py` exits with code 0\n- [ ] README.md and README_zh.md are both present\n- [ ] CONTRIBUTING.md is present\n- [ ] .gitignore is present\n- [ ] No hardcoded secrets anywhere in the codebase\n\n## Reporting Issues\n\nPlease report issues via GitHub Issues with:\n\n1. **What you expected to happen**\n2. **What actually happened**\n3. **Steps to reproduce**\n4. **Environment** (OS, Python version, etc.)\n\n## License\n\nBy contributing, you agree that your contributions will be licensed under the MIT License.\n\nFile v1.6.7:README_zh.md\n\n# MiniMax 套餐监控中心\n\n[English](./README.md)\n\n实时本地仪表盘，监控 MiniMax API 套餐使用情况，支持配额、按需速率测试、本周用量追踪、24 小时历史趋势。\n\n> **当前版本：v1.6.7** | [更新日志](CHANGELOG.md) | [许可证](LICENSE)\n\n![Dashboard](demo.png)\n\n![License](https://img.shields.io/badge/License-MIT-blue)\n\n---\n\n## v1.6.7 功能\n\n### 配额监控\n\n- 📊 **4 小时 / 24 小时 / 本周** 三档用量追踪 — 主圆环按用户当前 Token Plan 套餐的实际周期动态显示\n- 🎯 **模型卡片** 区分 4h 限额 / 24h 限额 / 周无限额 / 套餐未启用(视频模型 status=3 元数据不可区分时显示\"套餐未启用 · 不可调用\"提示并排除出 4h 聚合)\n- 📈 **24 小时趋势线** — 本地 `history.jsonl` 滚动 buffer 记录每次 `token_plan` 调用的用量快照\n\n### 速率测试(按需)\n\n- ⚡ **TTFT / P50 / 突发并发 / token·s** 四项指标,基于真实 chat completion 请求\n- ⚠️ **UI 红字 + confirm() 二次确认** — 每次测试消耗约 180 token,需用户主动确认,不点不动\n\n### 安全\n\n- 🔒 **本地凭证按需加载** — Server 启动**不读** `~/.mmx/config.json`。用户在仪表盘顶部点 \"加载本地凭证\" 按钮 + `confirm()` 二次确认后,才通过 `POST /api/load_cred` 读取 API key,存入 server 进程内存(不写磁盘、不写浏览器、不上传)\n- 🔒 **`/api/load_cred` 响应不含完整 API key** — 只回 `keyLength` + `keyPrefix`(前 6 字符,用于视觉确认 `sk-cp-` 前缀)\n- 🔒 **`/api/load_cred` 拒绝空 Referer** — 强制 `Referer` 是本机白名单 `127.0.0.1 / localhost / file://` 之一\n- 🔒 **CORS 严格** — `Access-Control-Allow-Origin` 仅放行 `127.0.0.1 / localhost / file://`\n- 🔒 **不向远程传输 key** — API key 永不离开本机\n\n---\n\n## 快速开始\n\n### 前置条件\n\n- Node.js ≥ 18\n\n### 运行\n\n```bash\n# 1. 启动后端服务\nnode mmx-monitor-server.js\n\n# 2. 打开浏览器(macOS 自动唤起 http://127.0.0.1:9877/)\nopen http://127.0.0.1:9877/\n# Windows / Linux: 手动访问 http://127.0.0.1:9877/\n```\n\n### 加载 API Key\n\n页面打开后,点击顶部 **\"加载本地凭证\"** 按钮 → 确认 → 从 `~/.mmx/config.json` 读取 key 存入 server 进程内存。或直接在输入框粘贴 key。\n\n---\n\n## 启动选项\n\n```bash\n# 默认\nnode mmx-monitor-server.js\n\n# 启用 X-MMX-API-Key header 透传(高级)\nnode mmx-monitor-server.js --allow-header-key\n\n# 关闭 /api/probe 端点(完全不发起推理调用)\nnode mmx-monitor-server.js --no-probe\n```\n\n---\n\n## 配置\n\n### mmx 本地配置(按需加载)\n\n后端服务**不**自动读取 `~/.mmx/config.json`。需要时点仪表盘顶部的 **\"加载本地凭证\"** 按钮,触发 `confirm()` 二次确认后才会调用 `POST /api/load_cred` 读取 API key,存入 server 进程内存(不写磁盘、不出现在 HTTP 响应里)。Server 重启后 key 丢失,需要重新点击按钮加载;未加载时所有需要 key 的端点返 401。\n\n### 环境变量(备选)\n\n如果 `~/.mmx/config.json` 不存在:\n\n```bash\n# 复制模板\ncp .env.example .env\n\nMINIMAX_API_KEY=sk-cp-…here           # MiniMax API Key(Token Plan 类型)\n```\n\n---\n\n## 安全与数据流\n\n**本服务默认会**:\n\n1. **按需加载本地凭证** — 仪表盘\"加载本地凭证\"按钮触发 `POST /api/load_cred`,从 `~/.mmx/config.json` 读取 API key 到 server 进程内存(不写浏览器 / 不写文件 / server 重启后丢失)。未加载时所有需要 key 的端点返 401。\n2. **每 60s 调 MiniMax API** — `https://www.minimaxi.com/v1/token_plan/remains` 拿配额数据。\n3. **写入本地用量采样** — 每次配额拉取后追加到 `<skill-dir>/history.jsonl`(24h 滚动 buffer,只含用量百分比,不含凭证)。\n4. **速率测试需用户主动触发** — 仪表盘按钮 + `confirm()` 才发起 5 次 chat completion 请求(约 180 token)。\n\n**本服务不会**:\n\n- 启动时自动读取 `~/.mmx/config.json`\n- 在任何 HTTP 响应中返回完整 API key\n- 接受空 Referer 调凭证加载端点\n- 允许跨源网页调用本机 server\n- 自动或定时运行速率测试\n\n---\n\n## API 端点\n\n| 端点 | 说明 |\n|------|------|\n| `POST /api/load_cred` | 从 `~/.mmx/config.json` 加载 API key(用户点按钮 + confirm) |\n| `GET /api/token_plan` | 从 MiniMax 官方拉取配额(需已加载 key) |\n| `GET /api/probe` | 按需 API 延迟探测(用户点按钮 + confirm,需已加载 key) |\n| `GET /api/history?hours=24` | 24h 用量历史(本地滚动 buffer) |\n| `GET /health` | 健康检查 |\n\n---\n\n## 文件说明\n\n| 文件 | 说明 |\n|------|------|\n| `mmx-monitor.html` | 监控页面(单文件 HTML 前端) |\n| `mmx-monitor-server.js` | 本地代理服务(Node.js,端口 9877) |\n| `history.jsonl` | 24h 用量历史滚动 buffer(自动生成,不入 git) |\n| `SKILL.md` | 技能定义 |\n| `CHANGELOG.md` | 完整版本历史 |\n| `demo.png` | 仪表盘截图 |\n| `LICENSE` | MIT 许可证 |\n\n---\n\n## 常见问题\n\n**Q: 点击查询后提示\"连接失败\"?**\nA: 确认后端服务在跑(`node mmx-monitor-server.js`)。\n\n**Q: 端口 9877 被占用?**\nA: 停掉占用该端口的进程,或修改 `mmx-monitor-server.js` 中的 `PORT` 常量。\n\n---\n\n## 许可证\n\nMIT License — 见 [LICENSE](LICENSE)。\n\nFile v1.6.7:skill-card.md\n\n## Description: <br>\nStarts and guides a local MiniMax quota dashboard for checking token-plan usage, viewing a 24-hour usage history, and optionally running user-confirmed latency probes. <br>\n\nThis skill is ready for commercial/non-commercial use. <br>\n\n## Publisher: <br>\n[wangjipeng977](https://clawhub.ai/user/wangjipeng977) <br>\n\n### License/Terms of Use: <br>\nMIT-0 <br>\n\n\n## Use Case: <br>\nDevelopers and MiniMax API users use this skill to open a local dashboard, load their MiniMax token-plan credential on demand, monitor remaining quota across 4-hour, 24-hour, and weekly windows, and run explicit latency checks when needed. <br>\n\n### Deployment Geography for Use: <br>\nGlobal <br>\n\n## Known Risks and Mitigations: <br>\nRisk: The local credential server uses the user's MiniMax API key and was assessed as broader than its safety claims imply. <br>\nMitigation: Install and run only on a trusted machine, keep port 9877 bound for local use, do not expose it to a LAN or the internet, and stop the server after use. <br>\nRisk: The server security guidance says the documented --no-probe disable flag is not enforced by the current code. <br>\nMitigation: Do not rely on --no-probe as the only control for preventing latency probes; avoid loading credentials or stop the server when probes must be unavailable. <br>\nRisk: Quota polling and opt-in latency probes make outbound MiniMax API calls and can consume account quota. <br>\nMitigation: Load credentials only when needed, review the probe confirmation before starting a test, and stop the server when real-time monitoring is no longer required. <br>\n\n\n## Reference(s): <br>\n- [ClawHub skill page](https://clawhub.ai/wangjipeng977/skills/minimax-monitor) <br>\n- [Release metadata source](https://github.com/MiniMax-AI/skills) <br>\n- [MiniMax token-plan quota endpoint](https://www.minimaxi.com/v1/token_plan/remains) <br>\n- [MiniMax chat completion endpoint](https://api.minimaxi.com/v1/text/chatcompletion_v2) <br>\n\n\n## Skill Output: <br>\n**Output Type(s):** [Shell commands, Configuration, Guidance, Text] <br>\n**Output Format:** [Markdown guidance with inline shell commands and local dashboard instructions] <br>\n**Output Parameters:** [1D] <br>\n**Other Properties Related to Output:** [May start a local Node.js server on port 9877 and write a local 24-hour usage history file.] <br>\n\n## Skill Version(s): <br>\n1.6.7 (source: server release metadata, SKILL.md metadata, README, and CHANGELOG released 2026-06-30) <br>\n\n## Ethical Considerations: <br>\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment. <br>\n\nArchive v1.6.6: 9 files, 34235 bytes\n\nFiles: CHANGELOG.md (6533b), CONTRIBUTING.md (2173b), mmx-monitor-server.js (23085b), mmx-monitor.html (32620b), README_zh.md (5292b), README.md (5228b), skill-card.md (2532b), SKILL.md (9841b), _meta.json (134b)\n\nFile v1.6.6:SKILL.md\n\n---\nname: minimax-monitor\ndescription: >\n  Use when (1) user says \"mmx 仪表盘启动\" / \"mmx monitor\" / \"MiniMax 配额查询\" / \"打开 minimax 监控\" and wants a real-time dashboard.\n  (2) user wants to check how much of their MiniMax Token Plan quota is left (4h / 24h / weekly windows for M3 / M2.7 / video / music / image models).\n  (3) user wants to test MiniMax inference latency (TTFT / P50 / burst) by clicking \"开始速率测试\" - explicitly opt-in, NOT background.\nlicense: MIT\nmetadata:\n  version: \"1.6.6\"\n  category: dev-tools\n  author: wangjipeng\n  sources:\n    - https://github.com/MiniMax-AI/skills\npermissions:\n  - read:filesystem       # ~/.mmx/config.json\n  - write:filesystem      # history.jsonl (24h ring buffer, 本技能目录)\n  - read:env               # MINIMAX_API_KEY\n  - network:outbound       # api.minimaxi.com / www.minimaxi.com\n  - shell:exec             # 'open' 命令启动浏览器\n---\n\n# MiniMax 套餐监控 + 速率测试中心\n\n> **触发词**:mmx 仪表盘启动\n>\n> **两个职责**:\n> 1. **实时配额查询** -- 60s 轮询官方 token_plan API,显示 4h / 24h / 本周用量、模型卡片、24h 趋势。\n> 2. **按需速率测试** -- 用户点 \"开始速率测试\" 按钮才发起 5 次 chat completion 请求(约 180 token 上限),返回 TTFT / P50 / burst / token-s。\n>\n> 启动后自动用 `open` 命令唤起浏览器打开 `http://127.0.0.1:9877/`。\n\n## v1.6.6 主要功能\n\n### 安全\n\n- 🔒 **本地凭证按需加载**。Server 启动**不读** `~/.mmx/config.json`。用户在仪表盘顶部点 \"加载本地凭证\" 按钮 + `confirm()` 二次确认后,才通过 `POST /api/load_cred` 读取 API key,存入 server 进程内存(不写磁盘、不写浏览器、不上传)。Server 重启后 key 丢失。\n- 🔒 **`/api/load_cred` 响应不含完整 API key**(只回 `keyLength` + `keyPrefix` 前 6 字符用于视觉确认)。\n- 🔒 **`/api/load_cred` 拒绝空 Referer**,强制 `Referer` 是本机白名单 `127.0.0.1 / localhost / file://` 之一。\n- 🔒 **CORS 严格**:`Access-Control-Allow-Origin` 仅放行 `127.0.0.1 / localhost / file://`。恶意网页无法跨域调本机 server 消耗你的 MiniMax 配额。\n- 🔒 **速率测试按需**:`/api/probe` 不再后台定时调用。仅在用户点 \"开始速率测试\" 按钮时才发起 5 次 chat completion,UI 红字提示 + 二次确认。\n\n### 配额监控\n\n- 📊 **4 小时 / 24 小时 / 本周** 三档用量追踪(4 小时为主圆环,按用户当前 Token Plan 套餐的实际周期动态显示)。\n- 🎯 **模型卡片** 区分 4h 限额 / 24h 限额 / 周无限额 / 套餐未启用(视频模型 status=3 元数据不可区分时显示 \"套餐未启用 · 不可调用\" 提示并排除出 4h 聚合)。\n- 📈 **24 小时趋势线**:`history.jsonl` 滚动 buffer(本技能目录)记录每次 `token_plan` 调用的用量快照,前端画趋势线。\n\n### 速率测试\n\n- ⚡ **TTFT / P50 / 突发并发 / token·s** 四项指标,基于真实 chat completion 请求。\n- ⚠️ **UI 红字 + confirm()** 提示每次测试消耗约 180 token,需用户主动确认。\n\n### 启动\n\n```bash\nnode ~/.openclaw/workspace/skills/minimax-monitor/mmx-monitor-server.js\n# 浏览器访问 http://127.0.0.1:9877/\n```\n\n高级选项:\n\n```bash\n# 启用 X-MMX-API-Key header 透传(默认拒绝)\nnode mmx-monitor-server.js --allow-header-key\n# 完全关闭速率测试端点\nnode mmx-monitor-server.js --no-probe\n```\n\n## Security & Data Flow\n\n本技能默认会:\n\n1. **读取本地凭证(按需)**:从 `~/.mmx/config.json` 读取 `api_key`(MiniMax Token Plan key)。**仅在用户主动点击 \"加载本地凭证\" 按钮时才会读**(`POST /api/load_cred`),server 启动时**不**读。读到的 key 存 server 进程内存,不写盘、不上传,server 重启后清空。\n2. **定时调用 MiniMax API**:每 60s 调 `https://www.minimaxi.com/v1/token_plan/remains` 拿配额数据。\n3. **写入本地采样数据**:每次 `fetchQuota` 后向 `<skill-dir>/history.jsonl` 追加一行 `(timestamp, usedPct, modelSnapshot)`,保留最近 24h 滚动 buffer,供前端画趋势线。不存凭证、不存个人信息。\n4. **速率测试需用户主动触发**:v1.6.0 起,仪表盘速率面板**不再自动**调用 chat completion。点 \"开始速率测试\" 按钮才会发起 5 次真实 chat 请求(约 180 token 上限),UI 会有红字提示 + 二次确认。\n\n**不会做**:\n\n- 不会把 API key 上传到任何远程(仅本地使用)。\n- 不会在 `load_cred` 响应里返回 key。\n- 不会允许跨源网页调用本机 server(CORS allowlist 限定 `127.0.0.1 / localhost / file://`)。\n- 不会接受空 Referer 调 `load_cred`(强制本机页面发起的请求才放行)。\n- 不会在后台悄悄消耗你的 chat 配额(v1.6.0 起 probe 改按需触发;不点不动)。\n\n**操作风险提示**:\n\n- **本地凭证访问**:点击 \"加载本地凭证\" 按钮会读取 `~/.mmx/config.json` 的 `api_key`,并把 key 存入本机 server 进程内存。建议:仅在本机使用本技能,不要把 9877 端口对外暴露。\n- **持续出站轮询**:每 60s 一次的 `token_plan/remains` 调用会持续消耗 MiniMax 配额查询额度(Token Plan 套餐内免费)。如果不需要实时面板,可手动 `Ctrl+C` 停 server。\n- **本地历史文件**:`history.jsonl` 包含时间序列的用量百分比,**不包含**凭证或个人身份信息;不慎泄漏也只是用量趋势。\n\n**想使用 header 透传 key**(高级用户,需要自负责):`node mmx-monitor-server.js --allow-header-key`\n\n---\n\n## Modes\n\n### `dashboard` (default)\nReal-time token-plan quota monitor. Server polls `https://www.minimaxi.com/v1/token_plan/remains` every 60s after credentials are loaded. Renders ring chart, per-model cards, and 24h trend line. **This is what runs by default when the user says \"mmx 仪表盘启动\".**\n\n### `probe` (opt-in)\nOn-demand inference latency test. Triggered **only** by the dashboard button \"开始速率测试\" - never by timer. Runs 5 chat completions against `api.minimaxi.com/v1/text/chatcompletion_v2` (model `MiniMax-M2.7`, max_tokens=30-60, mix of streaming/non-streaming). Returns TTFT, P50, burst, token/s metrics. **Costs ~180 tokens per click; UI shows red warning + confirm() dialog before firing.**\n\n### `history` (read-only)\nReads `history.jsonl` (24h ring buffer at `<skill-dir>/history.jsonl`) and returns time-series usage samples via `GET /api/history?hours=24`. No writes. Used by the dashboard's trend line widget.\n\n---\n\n## Do not\n\n- ❌ **Do not** auto-read `~/.mmx/config.json` on server startup. The credential is loaded **only** when the user explicitly clicks \"加载本地凭证\" (v1.6.0+).\n- ❌ **Do not** return the API key in any HTTP response body. `POST /api/load_cred` returns `keyLength` + `keyPrefix` only (v1.6.1+).\n- ❌ **Do not** accept empty `Referer` on `/api/load_cred`. Curl / CLI calls must include `-H 'Referer: http://127.0.0.1:9877/'` (v1.6.1+).\n- ❌ **Do not** run the inference probe in the background or on a timer. Probe is button-only, confirm-required, ~180 token cost per click (v1.6.0+).\n- ❌ **Do not** allow cross-origin web pages to reach the local server. CORS allowlist is `127.0.0.1 / localhost / file://` only (v1.4.0+).\n- ❌ **Do not** claim \"auto-read\" in any documentation. The only consistent narrative is \"on-demand, user-initiated, in-memory only\".\n\n---\n\n## Good vs. Bad Examples\n\n| Scenario | ❌ Bad (v1.5.x and earlier) | ✅ Good (v1.6.1+) |\n|----------|---------------------------|------------------|\n| Server startup | Reads `~/.mmx/config.json` silently; loads key into memory at boot | Reads nothing; `credLoadedKey = ''`; waits for user click |\n| User opens dashboard | Key is already in server, all panels work | All panels show 401; user clicks \"加载本地凭证\" → confirm → key loads |\n| `POST /api/load_cred` response | `{\"ok\":true, \"key\":\"sk-cp-...real-key-here...\"}` | `{\"ok\":true, \"keyLength\":125, \"keyPrefix\":\"sk-cp-\"}` |\n| curl `load_cred` with no headers | `{\"ok\":true, \"key\":\"...\"}` (key leaked) | `403 {\"ok\":false, \"error\":\"requires Referer from local origin\"}` |\n| Probe behavior | Background timer fires every 5 min, silently consumes quota | Button only; red warning + confirm() before firing; no background calls |\n| README \"Configuration\" section header | `### mmx Local Config (auto-read, recommended)` | `### mmx Local Config (loaded on demand, v1.6.0+)` |\n| Frontend localStorage | Key persisted 24h via \"Remember\" toggle | No localStorage; user re-pastes key per session |\n\n---\n\n## Quality Bar\n\nA **good** v1.6.1+ deploy of this skill satisfies:\n\n- ✅ Server starts and listens on port 9877 without reading any local credentials (verify with `pgrep -fl mmx-monitor` then `lsof -p <pid> -P -n` shows no `~/.mmx/config.json` open).\n- ✅ Empty-Refefer `POST /api/load_cred` returns 403, not 200.\n- ✅ Valid-Refefer `POST /api/load_cred` returns 200 with `key` field absent (only `keyLength` + `keyPrefix`).\n- ✅ `GET /api/token_plan` returns 401 with `{\"error\":\"API key 未加载...\"}` before any user action, and 200 with valid quota data after credential load.\n- ✅ `<skill-dir>/history.jsonl` is created on first `token_plan` poll and is mentioned in `SKILL.md` Security section + this file.\n- ✅ `SKILL.md` frontmatter `permissions:` lists `write:filesystem` (not just `read:filesystem`).\n- ✅ No \"auto-read\" wording remains in `README.md` / `README_zh.md` / `SKILL.md` after v1.6.1 changes.\n- ✅ ClawHub security audit finding count for this skill drops from 13 → ≤ 3 after v1.6.1 publish.\n\nA **bad** deploy:\n\n- ❌ `key` field still in `load_cred` response (regression to v1.6.0 bug).\n- ❌ `permissions:` missing `write:filesystem` (regression to v1.5.x).\n- ❌ README still says \"auto-read\" anywhere (audit trigger).\n- ❌ Empty-Refefer `load_cred` returns 200 (regression).\n\nFile v1.6.6:README.md\n\n# MiniMax Package Monitor\n\n[中文版](./README_zh.md)\n\nReal-time local dashboard for monitoring MiniMax API package usage — quota tracking, on-demand rate probing, weekly usage, and 24h history.\n\n> **Current Version: v1.6.6** | [CHANGELOG](CHANGELOG.md) | [License](LICENSE)\n\n![Dashboard](demo.png)\n\n![License](https://img.shields.io/badge/License-MIT-blue)\n\n---\n\n## Features (v1.6.6)\n\n### Quota Monitoring\n\n- 📊 **4-hour / 24-hour / weekly** usage windows — primary ring chart shows the user's actual Token Plan cycle\n- 🎯 **Per-model cards** distinguish 4h-capped / 24h-capped / no-weekly-limit / plan-not-enabled (video) cases\n- 📈 **24-hour trend line** from local `history.jsonl` ring buffer\n\n### Rate Probing (on-demand)\n\n- ⚡ **TTFT / P50 / burst / token·s** measurements from real chat completion requests\n- ⚠️ **Button-only with confirm() dialog** — costs ~180 tokens per click, never fires automatically\n\n### Security\n\n- 🔒 **Credential loaded on demand** — Server does **not** auto-read `~/.mmx/config.json`. Dashboard's \"加载本地凭证\" button + `confirm()` triggers `POST /api/load_cred`, key stored in server process memory only\n- 🔒 **`/api/load_cred` response excludes the full key** — returns `keyLength` + `keyPrefix` (first 6 chars) only\n- 🔒 **`/api/load_cred` rejects empty `Referer`** — must come from a local-origin page (`127.0.0.1 / localhost / file://`)\n- 🔒 **CORS allowlist** — only `127.0.0.1 / localhost / file://` can reach the local server\n- 🔒 **No remote key transmission** — API key never leaves the local machine\n\n---\n\n## Quick Start\n\n### Prerequisites\n\n- Node.js ≥ 18\n\n### Run\n\n```bash\n# 1. Start backend service\nnode mmx-monitor-server.js\n\n# 2. Open browser (macOS auto-opens http://127.0.0.1:9877/)\nopen http://127.0.0.1:9877/\n# Windows / Linux: navigate to http://127.0.0.1:9877/ manually\n```\n\n### Load API Key\n\nAfter the page loads, click **\"加载本地凭证\"** button → confirm → key loads from `~/.mmx/config.json` into server process memory. Or paste your key directly into the input box.\n\n---\n\n## Startup Options\n\n```bash\n# Default\nnode mmx-monitor-server.js\n\n# Enable X-MMX-API-Key header passthrough (advanced)\nnode mmx-monitor-server.js --allow-header-key\n\n# Disable /api/probe endpoint entirely (no inference calls)\nnode mmx-monitor-server.js --no-probe\n```\n\n---\n\n## Configuration\n\n### mmx Local Config (loaded on demand)\n\nThe backend **does not auto-read** `~/.mmx/config.json`. Use the dashboard's **\"加载本地凭证\"** button to explicitly load the API key into server process memory. The key is held only in memory (not written to disk, not returned in HTTP responses), and is cleared on server restart.\n\n### Environment Variable (fallback)\n\nIf `~/.mmx/config.json` is not present:\n\n```bash\n# Copy template\ncp .env.example .env\n\nMINIMAX_API_KEY=sk-cp-…here           # MiniMax API Key (Token Plan type)\n```\n\n---\n\n## Security & Data Flow\n\n**This service, by default, will**:\n\n1. **Load local credentials on demand** — Dashboard's \"加载本地凭证\" button triggers `POST /api/load_cred` which reads `~/.mmx/config.json` into server process memory (not browser, not disk). Server restart clears it. Endpoints requiring key return 401 until loaded.\n2. **Poll MiniMax API every 60s** — `https://www.minimaxi.com/v1/token_plan/remains` for quota data.\n3. **Write local usage samples** — `<skill-dir>/history.jsonl` is appended on each quota poll (24h ring buffer, contains usage percentages only, no credentials).\n4. **Run inference probe on user demand only** — Dashboard button + `confirm()` triggers `/api/probe` (5 chat completion requests, ~180 tokens).\n\n**This service will NOT**:\n\n- Auto-read `~/.mmx/config.json` on startup.\n- Return the API key in any HTTP response body.\n- Accept empty `Referer` for credential-loading requests.\n- Allow cross-origin web pages to reach the local server.\n- Run the inference probe automatically or on a timer.\n\n---\n\n## API Endpoints\n\n| Endpoint | Description |\n|----------|-------------|\n| `POST /api/load_cred` | Load API key from `~/.mmx/config.json` (user-clicks-button, confirm dialog required) |\n| `GET /api/token_plan` | Fetch quota from MiniMax official (requires loaded key) |\n| `GET /api/probe` | On-demand API latency probe (user-clicks-button, confirm dialog, requires loaded key) |\n| `GET /api/history?hours=24` | 24h usage history from local ring buffer |\n| `GET /health` | Health check |\n\n---\n\n## File Overview\n\n| File | Description |\n|------|-------------|\n| `mmx-monitor.html` | Monitoring page (single-file HTML frontend) |\n| `mmx-monitor-server.js` | Local proxy service (Node.js, port 9877) |\n| `history.jsonl` | 24h usage history ring buffer (auto-generated, gitignored) |\n| `SKILL.md` | Agent skill definition |\n| `CHANGELOG.md` | Full version history |\n| `demo.png` | Dashboard screenshot |\n| `LICENSE` | MIT License |\n\n---\n\n## FAQ\n\n**Q: Shows \"Connection Failed\" after clicking Query?**\nA: Make sure the backend service is running (`node mmx-monitor-server.js`).\n\n**Q: Port 9877 already in use?**\nA: Stop the process using that port, or modify the `PORT` constant in `mmx-monitor-server.js`.\n\n---\n\n## License\n\nMIT License — see [LICENSE](LICENSE).\n\nFile v1.6.6:_meta.json\n\n{\n  \"ownerId\": \"kn70zthc74p61mvctddrancx0s832g4r\",\n  \"slug\": \"minimax-monitor\",\n  \"version\": \"1.6.6\",\n  \"publishedAt\": 1782796890356\n}\n\nFile v1.6.6:CHANGELOG.md\n\n# Changelog\n\nAll notable changes to MiniMax Monitor will be documented in this file.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n\n## [1.6.6] - 2026-06-30\n\n### Documentation\n- 🐛 删除 SKILL.md frontmatter 顶层残留 `version: 1.6.2` 字段（ClawHub 优先解析顶层 key,导致 v1.6.3+ 发布后页面仍显示 v1.6.2）\n- 🐛 同步 README.md / README_zh.md 顶部 `Current Version` / `当前版本` 行以及 `## Features` / `## 功能` 段标题随发布版本一起更新\n\n## [1.6.5] - 2026-06-30\n\n### Documentation\n- 🐛 SKILL.md `metadata.version` 1.6.3 → 1.6.5（docs-only bump publish 链同步）\n\n## [1.6.3] - 2026-06-30\n\n### Security\n- 🐛 `/api/probe` 拒绝空 `Referer`（之前空 `Referer` 会被静默放行,绕过了本机 origin 二次确认 → curl/本机直连可直接触发真实 API 调用)\n- 🐛 加载本地凭证后,API key 不再写回 `input.value`（之前 key 进入 DOM,password 字段只是 UI 遮罩,肩窥/扩展/DevTools 仍可读）——现在只存内存变量,input 显示占位符,加 `data-loaded=\"1\"` 标记让「查询」按钮识别「已加载」状态不要覆盖\n\n## [1.6.2] - 2026-06-29\n\n### Security\n- 🐛 `/api/probe` 拒绝空 `Referer`（之前空 `Referer` 会被静默放行,绕过了本机 origin 二次确认 → curl/本机直连可直接触发真实 API 调用)\n- 🐛 加载本地凭证后,API key 不再写回 `input.value`（之前 key 进入 DOM,password 字段只是 UI 遮罩,肩窥/扩展/DevTools 仍可读）——现在只存内存变量,input 显示占位符,加 `data-loaded=\"1\"` 标记让「查询」按钮识别「已加载」状态不要覆盖\n\n### Documentation\n- 🧹 SKILL.md 删「## 更新日志」整段（v1.6.0/v1.5.0/v1.4.0/...）— ClawHub 全文渲染不再堆历史\n- 🧹 SKILL.md 删 Security 重复段 + 删冗余「技能简介 / 触发词收敛 / 文件说明 / 使用方式 / 环境变量 / 注意事项」段\n- 🧹 README.md / README_zh.md 重写 — 顶部「Current Version: v1.6.1」+「Features (v1.6.1)」只描述当前版本功能，不堆 Changelog 历史\n- 🧹 CHANGELOG.md 重写 — 保留累积变更（行业惯例），精简每版条目、去掉审计器 finding 编号等内部叙事噪音\n\n## [1.6.1] - 2026-06-29\n\n### Security\n- 🐛 `/api/load_cred` 响应不再返回完整 API key（只回 `keyLength` + `keyPrefix` 前 6 字符）\n- 🐛 `/api/load_cred` 拒绝空 `Referer`，强制本机白名单\n- 📝 SKILL.md frontmatter `permissions` 补 `write:filesystem`（声明 `history.jsonl` 写入）\n\n### Documentation\n- 🧹 清理 README 自相矛盾 — 所有\"自动读取 `~/.mmx/config.json`\"的旧表述统一改为\"按需主动加载\"叙事\n- 📝 SKILL.md Security 段重写 + 加 `history.jsonl` 持久化披露 + 操作风险提示\n- 📝 新增 CONTRIBUTING.md\n\n## [1.6.0] - 2026-06-26\n\n### Security Hardening\n- 🔒 凭证按需加载 — Server 启动不读 `~/.mmx/config.json`，仪表盘点 \"加载本地凭证\" 按钮 + confirm 才读\n- 🔒 删除浏览器 localStorage 24h 记忆 — 重启后必须重新输入或重新加载\n- 🔒 速率测试改按需 — 仪表盘速率面板不再自动调用 chat completion，需用户点 \"开始速率测试\" 按钮 + confirm\n- 🔒 删除飞书推送 — 飞书 OAuth 协议要求发 `FEISHU_APP_SECRET`，无法通过文档警示消除该风险\n\n### Other\n- 🛠 Server 直接服务 HTML（`http://127.0.0.1:9877/`），绕开 Safari `file://` fetch 报错\n- 📝 SKILL.md description 改为诚实版（\"套餐监控 + 速率测试\"双职责）\n\n## [1.5.1] - 2026-06-26\n\n### Changed\n- 🔒 触发词收敛为单一 `mmx 仪表盘启动`（从 4 个泛词收敛），降低误触概率\n- 🛑 飞书推送不再走对话触发\n\n## [1.5.0] - 2026-06-25\n\n### Features\n- 🆕 `/api/history` 端点（24h 滚动 buffer）— `history.jsonl` 记录用量快照，前端画趋势线\n- 🆕 主面板响应式高度（`min(560px, 100vh-150px)`）— 小屏笔记本不滚动\n- 🆕 双语 README — 英文 + 中文互相跳转\n\n## [1.4.0] - 2026-06-25\n\n### Security\n- 🔒 CORS 严格化 — `Access-Control-Allow-Origin` 改为 `127.0.0.1/localhost/file://` allowlist\n- 🔒 Header API key 默认拒绝（`--allow-header-key` 显式开启）\n- 🔒 `localStorage` 默认不自动加载（\"记住 24 小时\"勾选后才写）\n- 🔒 `--no-probe` flag 关闭速率测试端点\n- 📄 新增 Security & Data Flow 章节\n\n## [1.3.0] - 2026-06-24\n\n### Features\n- 🆕 视频模型\"套餐未启用\"识别（`status=3` 元数据无法区分真实无限额 vs 套餐未启用）\n- 🆕 套餐对比 banner（海螺视频卡片内嵌三档套餐升级面板）\n- 🆕 无周限账号识别（`current_weekly_status=3` 显示\"无周限\"）\n- 🆕 适配官方 Token Plan 新格式（`*_remaining_percent` 剩余百分比）\n- 🔧 端口 9876 → 9877（避让 minimax-embedding-adapter）\n\n### Bug Fixes\n- 🐛 大圆环 `dasharray` bug — 硬编码 515（= 2πr），实际半圆 πr ≈ 257.6\n- 🐛 流式响应解析错误 — SSE 多行格式 `parseJson` 整块失败\n\n## [1.2.0] - 2026-06-23\n\n### Features\n- 🆕 适配官方 Token Plan 新格式（同 v1.3.0）\n- 🆕 stat 数字加 % 后缀\n\n### Bug Fixes\n- 🐛 大圆环 `dasharray` bug（同 v1.3.0）\n\n## [1.1.0] - 2026-04-26\n\n### Features\n- 🆕 标签页自动刷新 — 切换回浏览器标签时触发一次配额和速率数据刷新\n\n## [1.0.0] - 2026-04-26\n\n### Initial Release\n- 实时配额仪表盘（5h 重置倒计时、模型明细、本周配额）\n- API 速率探针（SEQ-10 顺序、BURST-3 并发、TTFT、延迟、Tokens/s）\n- 飞书推送（可选）\n- 双层卡片布局（glass-card 玻璃质感）\n\n[1.6.2]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.6.1...v1.6.2\n[1.6.1]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.6.0...v1.6.1\n[1.6.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.5.1...v1.6.0\n[1.5.1]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.5.0...v1.5.1\n[1.5.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.4.0...v1.5.0\n[1.4.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.3.0...v1.4.0\n[1.3.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.2.0...v1.3.0\n[1.2.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.1.0...v1.2.0\n[1.1.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.0.0...v1.1.0\n\nFile v1.6.6:CONTRIBUTING.md\n\n# Contributing to `minimax-monitor`\n\nThank you for your interest in contributing! Please follow these steps to set up your development environment and submit changes.\n\n## Development Setup\n\n```bash\n# 1. Fork the repository on GitHub\n\n# 2. Clone your fork\ngit clone https://github.com/wangjipeng977/minimax-monitor.git\ncd minimax-monitor\n\n# 3. Install dependencies (none — pure Node.js stdlib, no npm install needed)\n\n# 4. Run the self-audit to verify quality\npython ~/.openclaw/workspace/skills/skill-factory/scripts/audit_skill.py . --hit-score\n```\n\n## Workflow\n\nWe use a standard feature branch workflow:\n\n```bash\n# 1. Create a new branch from main\ngit checkout -b feat/<your-feature-name>\n\n# 2. Make your changes\n#    - Follow the SKILL.md structure standards\n#    - Keep SKILL.md body in English\n#    - Do not hardcode API keys or secrets\n\n# 3. Run the audit to check for issues\npython scripts/audit_skill.py .\n\n# 4. Commit your changes\ngit add .\ngit commit -m \"feat(minimax-monitor): add <brief description>\"\n\n# 5. Push to your fork\ngit push origin feat/<your-feature-name>\n\n# 6. Open a Pull Request on GitHub\n#    - Title: feat(minimax-monitor): add <brief description>\n#    - Description: What + Why + Testing\n```\n\n## Code Standards\n\n- **SKILL.md**: Follow the YAML frontmatter standard (name, description, license, metadata)\n- **Scripts**: Must include shebang, requirements.txt, and graceful error handling\n- **Language**: SKILL.md body must be in English; reference docs in English\n- **No secrets**: Never commit API keys, tokens, or credentials\n\n## Quality Checklist\n\nBefore opening a PR, verify:\n\n- [ ] `audit_skill.py` exits with code 0 or 2\n- [ ] `validate_skills.py` exits with code 0\n- [ ] README.md and README_zh.md are both present\n- [ ] CONTRIBUTING.md is present\n- [ ] .gitignore is present\n- [ ] No hardcoded secrets anywhere in the codebase\n\n## Reporting Issues\n\nPlease report issues via GitHub Issues with:\n\n1. **What you expected to happen**\n2. **What actually happened**\n3. **Steps to reproduce**\n4. **Environment** (OS, Python version, etc.)\n\n## License\n\nBy contributing, you agree that your contributions will be licensed under the MIT License.\n\nFile v1.6.6:README_zh.md\n\n# MiniMax 套餐监控中心\n\n[English](./README.md)\n\n实时本地仪表盘，监控 MiniMax API 套餐使用情况，支持配额、按需速率测试、本周用量追踪、24 小时历史趋势。\n\n> **当前版本：v1.6.6** | [更新日志](CHANGELOG.md) | [许可证](LICENSE)\n\n![Dashboard](demo.png)\n\n![License](https://img.shields.io/badge/License-MIT-blue)\n\n---\n\n## v1.6.6 功能\n\n### 配额监控\n\n- 📊 **4 小时 / 24 小时 / 本周** 三档用量追踪 — 主圆环按用户当前 Token Plan 套餐的实际周期动态显示\n- 🎯 **模型卡片** 区分 4h 限额 / 24h 限额 / 周无限额 / 套餐未启用(视频模型 status=3 元数据不可区分时显示\"套餐未启用 · 不可调用\"提示并排除出 4h 聚合)\n- 📈 **24 小时趋势线** — 本地 `history.jsonl` 滚动 buffer 记录每次 `token_plan` 调用的用量快照\n\n### 速率测试(按需)\n\n- ⚡ **TTFT / P50 / 突发并发 / token·s** 四项指标,基于真实 chat completion 请求\n- ⚠️ **UI 红字 + confirm() 二次确认** — 每次测试消耗约 180 token,需用户主动确认,不点不动\n\n### 安全\n\n- 🔒 **本地凭证按需加载** — Server 启动**不读** `~/.mmx/config.json`。用户在仪表盘顶部点 \"加载本地凭证\" 按钮 + `confirm()` 二次确认后,才通过 `POST /api/load_cred` 读取 API key,存入 server 进程内存(不写磁盘、不写浏览器、不上传)\n- 🔒 **`/api/load_cred` 响应不含完整 API key** — 只回 `keyLength` + `keyPrefix`(前 6 字符,用于视觉确认 `sk-cp-` 前缀)\n- 🔒 **`/api/load_cred` 拒绝空 Referer** — 强制 `Referer` 是本机白名单 `127.0.0.1 / localhost / file://` 之一\n- 🔒 **CORS 严格** — `Access-Control-Allow-Origin` 仅放行 `127.0.0.1 / localhost / file://`\n- 🔒 **不向远程传输 key** — API key 永不离开本机\n\n---\n\n## 快速开始\n\n### 前置条件\n\n- Node.js ≥ 18\n\n### 运行\n\n```bash\n# 1. 启动后端服务\nnode mmx-monitor-server.js\n\n# 2. 打开浏览器(macOS 自动唤起 http://127.0.0.1:9877/)\nopen http://127.0.0.1:9877/\n# Windows / Linux: 手动访问 http://127.0.0.1:9877/\n```\n\n### 加载 API Key\n\n页面打开后,点击顶部 **\"加载本地凭证\"** 按钮 → 确认 → 从 `~/.mmx/config.json` 读取 key 存入 server 进程内存。或直接在输入框粘贴 key。\n\n---\n\n## 启动选项\n\n```bash\n# 默认\nnode mmx-monitor-server.js\n\n# 启用 X-MMX-API-Key header 透传(高级)\nnode mmx-monitor-server.js --allow-header-key\n\n# 关闭 /api/probe 端点(完全不发起推理调用)\nnode mmx-monitor-server.js --no-probe\n```\n\n---\n\n## 配置\n\n### mmx 本地配置(按需加载)\n\n后端服务**不**自动读取 `~/.mmx/config.json`。需要时点仪表盘顶部的 **\"加载本地凭证\"** 按钮,触发 `confirm()` 二次确认后才会调用 `POST /api/load_cred` 读取 API key,存入 server 进程内存(不写磁盘、不出现在 HTTP 响应里)。Server 重启后 key 丢失,需要重新点击按钮加载;未加载时所有需要 key 的端点返 401。\n\n### 环境变量(备选)\n\n如果 `~/.mmx/config.json` 不存在:\n\n```bash\n# 复制模板\ncp .env.example .env\n\nMINIMAX_API_KEY=sk-cp-…here           # MiniMax API Key(Token Plan 类型)\n```\n\n---\n\n## 安全与数据流\n\n**本服务默认会**:\n\n1. **按需加载本地凭证** — 仪表盘\"加载本地凭证\"按钮触发 `POST /api/load_cred`,从 `~/.mmx/config.json` 读取 API key 到 server 进程内存(不写浏览器 / 不写文件 / server 重启后丢失)。未加载时所有需要 key 的端点返 401。\n2. **每 60s 调 MiniMax API** — `https://www.minimaxi.com/v1/token_plan/remains` 拿配额数据。\n3. **写入本地用量采样** — 每次配额拉取后追加到 `<skill-dir>/history.jsonl`(24h 滚动 buffer,只含用量百分比,不含凭证)。\n4. **速率测试需用户主动触发** — 仪表盘按钮 + `confirm()` 才发起 5 次 chat completion 请求(约 180 token)。\n\n**本服务不会**:\n\n- 启动时自动读取 `~/.mmx/config.json`\n- 在任何 HTTP 响应中返回完整 API key\n- 接受空 Referer 调凭证加载端点\n- 允许跨源网页调用本机 server\n- 自动或定时运行速率测试\n\n---\n\n## API 端点\n\n| 端点 | 说明 |\n|------|------|\n| `POST /api/load_cred` | 从 `~/.mmx/config.json` 加载 API key(用户点按钮 + confirm) |\n| `GET /api/token_plan` | 从 MiniMax 官方拉取配额(需已加载 key) |\n| `GET /api/probe` | 按需 API 延迟探测(用户点按钮 + confirm,需已加载 key) |\n| `GET /api/history?hours=24` | 24h 用量历史(本地滚动 buffer) |\n| `GET /health` | 健康检查 |\n\n---\n\n## 文件说明\n\n| 文件 | 说明 |\n|------|------|\n| `mmx-monitor.html` | 监控页面(单文件 HTML 前端) |\n| `mmx-monitor-server.js` | 本地代理服务(Node.js,端口 9877) |\n| `history.jsonl` | 24h 用量历史滚动 buffer(自动生成,不入 git) |\n| `SKILL.md` | 技能定义 |\n| `CHANGELOG.md` | 完整版本历史 |\n| `demo.png` | 仪表盘截图 |\n| `LICENSE` | MIT 许可证 |\n\n---\n\n## 常见问题\n\n**Q: 点击查询后提示\"连接失败\"?**\nA: 确认后端服务在跑(`node mmx-monitor-server.js`)。\n\n**Q: 端口 9877 被占用?**\nA: 停掉占用该端口的进程,或修改 `mmx-monitor-server.js` 中的 `PORT` 常量。\n\n---\n\n## 许可证\n\nMIT License — 见 [LICENSE](LICENSE)。\n\nFile v1.6.6:skill-card.md\n\n## Description: <br>\nMinimax Monitor provides a local dashboard for checking MiniMax Token Plan quota windows and running user-confirmed inference latency probes. <br>\n\nThis skill is ready for commercial/non-commercial use. <br>\n\n## Publisher: <br>\n[wangjipeng977](https://clawhub.ai/user/wangjipeng977) <br>\n\n### License/Terms of Use: <br>\nMIT-0 <br>\n\n\n## Use Case: <br>\nDevelopers and MiniMax API users use this skill to launch a local quota-monitoring dashboard, inspect 4-hour, 24-hour, and weekly usage, and optionally run latency probes after explicit confirmation. <br>\n\n### Deployment Geography for Use: <br>\nGlobal <br>\n\n## Known Risks and Mitigations: <br>\nRisk: The local dashboard handles MiniMax API credentials and quota-consuming requests without strong local-only containment. <br>\nMitigation: Keep port 9877 bound or firewalled to localhost, do not expose it to other users or devices, and load credentials only while actively using the dashboard. <br>\nRisk: Inference probes make real MiniMax chat completion requests and can consume quota. <br>\nMitigation: Use the probe only after reviewing the dashboard warning and confirmation prompt; do not rely on --no-probe as the sole control in this version. <br>\nRisk: Loaded credentials remain in the local server process memory for the session. <br>\nMitigation: Stop or restart the server after use to clear the in-memory key, and avoid loading credentials on shared or remotely reachable machines. <br>\n\n\n## Reference(s): <br>\n- [ClawHub Skill Page](https://clawhub.ai/wangjipeng977/skills/minimax-monitor) <br>\n- [Publisher Profile](https://clawhub.ai/user/wangjipeng977) <br>\n- [Metadata Source](https://github.com/MiniMax-AI/skills) <br>\n\n\n## Skill Output: <br>\n**Output Type(s):** [text, markdown, shell commands, configuration, guidance] <br>\n**Output Format:** [Markdown guidance with inline shell commands and configuration notes] <br>\n**Output Parameters:** [1D] <br>\n**Other Properties Related to Output:** [May guide the agent to start a local Node.js dashboard, load MiniMax credentials on demand, poll quota data, and write local usage history.] <br>\n\n## Skill Version(s): <br>\n1.6.6 (source: evidence release, metadata.version, and artifact changelog released 2026-06-30) <br>\n\n## Ethical Considerations: <br>\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment. <br>\n\nArchive v1.6.5: 9 files, 34087 bytes\n\nFiles: CHANGELOG.md (6045b), CONTRIBUTING.md (2173b), mmx-monitor-server.js (23085b), mmx-monitor.html (32620b), README_zh.md (5292b), README.md (5228b), skill-card.md (2552b), SKILL.md (9841b), _meta.json (134b)\n\nFile v1.6.5:SKILL.md\n\n---\nname: minimax-monitor\ndescription: >\n  Use when (1) user says \"mmx 仪表盘启动\" / \"mmx monitor\" / \"MiniMax 配额查询\" / \"打开 minimax 监控\" and wants a real-time dashboard.\n  (2) user wants to check how much of their MiniMax Token Plan quota is left (4h / 24h / weekly windows for M3 / M2.7 / video / music / image models).\n  (3) user wants to test MiniMax inference latency (TTFT / P50 / burst) by clicking \"开始速率测试\" - explicitly opt-in, NOT background.\nlicense: MIT\nmetadata:\n  version: \"1.6.5\"\n  category: dev-tools\n  author: wangjipeng\n  sources:\n    - https://github.com/MiniMax-AI/skills\npermissions:\n  - read:filesystem       # ~/.mmx/config.json\n  - write:filesystem      # history.jsonl (24h ring buffer, 本技能目录)\n  - read:env               # MINIMAX_API_KEY\n  - network:outbound       # api.minimaxi.com / www.minimaxi.com\n  - shell:exec             # 'open' 命令启动浏览器\n---\n\n# MiniMax 套餐监控 + 速率测试中心\n\n> **触发词**:mmx 仪表盘启动\n>\n> **两个职责**:\n> 1. **实时配额查询** -- 60s 轮询官方 token_plan API,显示 4h / 24h / 本周用量、模型卡片、24h 趋势。\n> 2. **按需速率测试** -- 用户点 \"开始速率测试\" 按钮才发起 5 次 chat completion 请求(约 180 token 上限),返回 TTFT / P50 / burst / token-s。\n>\n> 启动后自动用 `open` 命令唤起浏览器打开 `http://127.0.0.1:9877/`。\n\n## v1.6.3 主要功能\n\n### 安全\n\n- 🔒 **本地凭证按需加载**。Server 启动**不读** `~/.mmx/config.json`。用户在仪表盘顶部点 \"加载本地凭证\" 按钮 + `confirm()` 二次确认后,才通过 `POST /api/load_cred` 读取 API key,存入 server 进程内存(不写磁盘、不写浏览器、不上传)。Server 重启后 key 丢失。\n- 🔒 **`/api/load_cred` 响应不含完整 API key**(只回 `keyLength` + `keyPrefix` 前 6 字符用于视觉确认)。\n- 🔒 **`/api/load_cred` 拒绝空 Referer**,强制 `Referer` 是本机白名单 `127.0.0.1 / localhost / file://` 之一。\n- 🔒 **CORS 严格**:`Access-Control-Allow-Origin` 仅放行 `127.0.0.1 / localhost / file://`。恶意网页无法跨域调本机 server 消耗你的 MiniMax 配额。\n- 🔒 **速率测试按需**:`/api/probe` 不再后台定时调用。仅在用户点 \"开始速率测试\" 按钮时才发起 5 次 chat completion,UI 红字提示 + 二次确认。\n\n### 配额监控\n\n- 📊 **4 小时 / 24 小时 / 本周** 三档用量追踪(4 小时为主圆环,按用户当前 Token Plan 套餐的实际周期动态显示)。\n- 🎯 **模型卡片** 区分 4h 限额 / 24h 限额 / 周无限额 / 套餐未启用(视频模型 status=3 元数据不可区分时显示 \"套餐未启用 · 不可调用\" 提示并排除出 4h 聚合)。\n- 📈 **24 小时趋势线**:`history.jsonl` 滚动 buffer(本技能目录)记录每次 `token_plan` 调用的用量快照,前端画趋势线。\n\n### 速率测试\n\n- ⚡ **TTFT / P50 / 突发并发 / token·s** 四项指标,基于真实 chat completion 请求。\n- ⚠️ **UI 红字 + confirm()** 提示每次测试消耗约 180 token,需用户主动确认。\n\n### 启动\n\n```bash\nnode ~/.openclaw/workspace/skills/minimax-monitor/mmx-monitor-server.js\n# 浏览器访问 http://127.0.0.1:9877/\n```\n\n高级选项:\n\n```bash\n# 启用 X-MMX-API-Key header 透传(默认拒绝)\nnode mmx-monitor-server.js --allow-header-key\n# 完全关闭速率测试端点\nnode mmx-monitor-server.js --no-probe\n```\n\n## Security & Data Flow\n\n本技能默认会:\n\n1. **读取本地凭证(按需)**:从 `~/.mmx/config.json` 读取 `api_key`(MiniMax Token Plan key)。**仅在用户主动点击 \"加载本地凭证\" 按钮时才会读**(`POST /api/load_cred`),server 启动时**不**读。读到的 key 存 server 进程内存,不写盘、不上传,server 重启后清空。\n2. **定时调用 MiniMax API**:每 60s 调 `https://www.minimaxi.com/v1/token_plan/remains` 拿配额数据。\n3. **写入本地采样数据**:每次 `fetchQuota` 后向 `<skill-dir>/history.jsonl` 追加一行 `(timestamp, usedPct, modelSnapshot)`,保留最近 24h 滚动 buffer,供前端画趋势线。不存凭证、不存个人信息。\n4. **速率测试需用户主动触发**:v1.6.0 起,仪表盘速率面板**不再自动**调用 chat completion。点 \"开始速率测试\" 按钮才会发起 5 次真实 chat 请求(约 180 token 上限),UI 会有红字提示 + 二次确认。\n\n**不会做**:\n\n- 不会把 API key 上传到任何远程(仅本地使用)。\n- 不会在 `load_cred` 响应里返回 key。\n- 不会允许跨源网页调用本机 server(CORS allowlist 限定 `127.0.0.1 / localhost / file://`)。\n- 不会接受空 Referer 调 `load_cred`(强制本机页面发起的请求才放行)。\n- 不会在后台悄悄消耗你的 chat 配额(v1.6.0 起 probe 改按需触发;不点不动)。\n\n**操作风险提示**:\n\n- **本地凭证访问**:点击 \"加载本地凭证\" 按钮会读取 `~/.mmx/config.json` 的 `api_key`,并把 key 存入本机 server 进程内存。建议:仅在本机使用本技能,不要把 9877 端口对外暴露。\n- **持续出站轮询**:每 60s 一次的 `token_plan/remains` 调用会持续消耗 MiniMax 配额查询额度(Token Plan 套餐内免费)。如果不需要实时面板,可手动 `Ctrl+C` 停 server。\n- **本地历史文件**:`history.jsonl` 包含时间序列的用量百分比,**不包含**凭证或个人身份信息;不慎泄漏也只是用量趋势。\n\n**想使用 header 透传 key**(高级用户,需要自负责):`node mmx-monitor-server.js --allow-header-key`\n\n---\n\n## Modes\n\n### `dashboard` (default)\nReal-time token-plan quota monitor. Server polls `https://www.minimaxi.com/v1/token_plan/remains` every 60s after credentials are loaded. Renders ring chart, per-model cards, and 24h trend line. **This is what runs by default when the user says \"mmx 仪表盘启动\".**\n\n### `probe` (opt-in)\nOn-demand inference latency test. Triggered **only** by the dashboard button \"开始速率测试\" - never by timer. Runs 5 chat completions against `api.minimaxi.com/v1/text/chatcompletion_v2` (model `MiniMax-M2.7`, max_tokens=30-60, mix of streaming/non-streaming). Returns TTFT, P50, burst, token/s metrics. **Costs ~180 tokens per click; UI shows red warning + confirm() dialog before firing.**\n\n### `history` (read-only)\nReads `history.jsonl` (24h ring buffer at `<skill-dir>/history.jsonl`) and returns time-series usage samples via `GET /api/history?hours=24`. No writes. Used by the dashboard's trend line widget.\n\n---\n\n## Do not\n\n- ❌ **Do not** auto-read `~/.mmx/config.json` on server startup. The credential is loaded **only** when the user explicitly clicks \"加载本地凭证\" (v1.6.0+).\n- ❌ **Do not** return the API key in any HTTP response body. `POST /api/load_cred` returns `keyLength` + `keyPrefix` only (v1.6.1+).\n- ❌ **Do not** accept empty `Referer` on `/api/load_cred`. Curl / CLI calls must include `-H 'Referer: http://127.0.0.1:9877/'` (v1.6.1+).\n- ❌ **Do not** run the inference probe in the background or on a timer. Probe is button-only, confirm-required, ~180 token cost per click (v1.6.0+).\n- ❌ **Do not** allow cross-origin web pages to reach the local server. CORS allowlist is `127.0.0.1 / localhost / file://` only (v1.4.0+).\n- ❌ **Do not** claim \"auto-read\" in any documentation. The only consistent narrative is \"on-demand, user-initiated, in-memory only\".\n\n---\n\n## Good vs. Bad Examples\n\n| Scenario | ❌ Bad (v1.5.x and earlier) | ✅ Good (v1.6.1+) |\n|----------|---------------------------|------------------|\n| Server startup | Reads `~/.mmx/config.json` silently; loads key into memory at boot | Reads nothing; `credLoadedKey = ''`; waits for user click |\n| User opens dashboard | Key is already in server, all panels work | All panels show 401; user clicks \"加载本地凭证\" → confirm → key loads |\n| `POST /api/load_cred` response | `{\"ok\":true, \"key\":\"sk-cp-...real-key-here...\"}` | `{\"ok\":true, \"keyLength\":125, \"keyPrefix\":\"sk-cp-\"}` |\n| curl `load_cred` with no headers | `{\"ok\":true, \"key\":\"...\"}` (key leaked) | `403 {\"ok\":false, \"error\":\"requires Referer from local origin\"}` |\n| Probe behavior | Background timer fires every 5 min, silently consumes quota | Button only; red warning + confirm() before firing; no background calls |\n| README \"Configuration\" section header | `### mmx Local Config (auto-read, recommended)` | `### mmx Local Config (loaded on demand, v1.6.0+)` |\n| Frontend localStorage | Key persisted 24h via \"Remember\" toggle | No localStorage; user re-pastes key per session |\n\n---\n\n## Quality Bar\n\nA **good** v1.6.1+ deploy of this skill satisfies:\n\n- ✅ Server starts and listens on port 9877 without reading any local credentials (verify with `pgrep -fl mmx-monitor` then `lsof -p <pid> -P -n` shows no `~/.mmx/config.json` open).\n- ✅ Empty-Refefer `POST /api/load_cred` returns 403, not 200.\n- ✅ Valid-Refefer `POST /api/load_cred` returns 200 with `key` field absent (only `keyLength` + `keyPrefix`).\n- ✅ `GET /api/token_plan` returns 401 with `{\"error\":\"API key 未加载...\"}` before any user action, and 200 with valid quota data after credential load.\n- ✅ `<skill-dir>/history.jsonl` is created on first `token_plan` poll and is mentioned in `SKILL.md` Security section + this file.\n- ✅ `SKILL.md` frontmatter `permissions:` lists `write:filesystem` (not just `read:filesystem`).\n- ✅ No \"auto-read\" wording remains in `README.md` / `README_zh.md` / `SKILL.md` after v1.6.1 changes.\n- ✅ ClawHub security audit finding count for this skill drops from 13 → ≤ 3 after v1.6.1 publish.\n\nA **bad** deploy:\n\n- ❌ `key` field still in `load_cred` response (regression to v1.6.0 bug).\n- ❌ `permissions:` missing `write:filesystem` (regression to v1.5.x).\n- ❌ README still says \"auto-read\" anywhere (audit trigger).\n- ❌ Empty-Refefer `load_cred` returns 200 (regression).\n\nFile v1.6.5:README.md\n\n# MiniMax Package Monitor\n\n[中文版](./README_zh.md)\n\nReal-time local dashboard for monitoring MiniMax API package usage — quota tracking, on-demand rate probing, weekly usage, and 24h history.\n\n> **Current Version: v1.6.3** | [CHANGELOG](CHANGELOG.md) | [License](LICENSE)\n\n![Dashboard](demo.png)\n\n![License](https://img.shields.io/badge/License-MIT-blue)\n\n---\n\n## Features (v1.6.3)\n\n### Quota Monitoring\n\n- 📊 **4-hour / 24-hour / weekly** usage windows — primary ring chart shows the user's actual Token Plan cycle\n- 🎯 **Per-model cards** distinguish 4h-capped / 24h-capped / no-weekly-limit / plan-not-enabled (video) cases\n- 📈 **24-hour trend line** from local `history.jsonl` ring buffer\n\n### Rate Probing (on-demand)\n\n- ⚡ **TTFT / P50 / burst / token·s** measurements from real chat completion requests\n- ⚠️ **Button-only with confirm() dialog** — costs ~180 tokens per click, never fires automatically\n\n### Security\n\n- 🔒 **Credential loaded on demand** — Server does **not** auto-read `~/.mmx/config.json`. Dashboard's \"加载本地凭证\" button + `confirm()` triggers `POST /api/load_cred`, key stored in server process memory only\n- 🔒 **`/api/load_cred` response excludes the full key** — returns `keyLength` + `keyPrefix` (first 6 chars) only\n- 🔒 **`/api/load_cred` rejects empty `Referer`** — must come from a local-origin page (`127.0.0.1 / localhost / file://`)\n- 🔒 **CORS allowlist** — only `127.0.0.1 / localhost / file://` can reach the local server\n- 🔒 **No remote key transmission** — API key never leaves the local machine\n\n---\n\n## Quick Start\n\n### Prerequisites\n\n- Node.js ≥ 18\n\n### Run\n\n```bash\n# 1. Start backend service\nnode mmx-monitor-server.js\n\n# 2. Open browser (macOS auto-opens http://127.0.0.1:9877/)\nopen http://127.0.0.1:9877/\n# Windows / Linux: navigate to http://127.0.0.1:9877/ manually\n```\n\n### Load API Key\n\nAfter the page loads, click **\"加载本地凭证\"** button → confirm → key loads from `~/.mmx/config.json` into server process memory. Or paste your key directly into the input box.\n\n---\n\n## Startup Options\n\n```bash\n# Default\nnode mmx-monitor-server.js\n\n# Enable X-MMX-API-Key header passthrough (advanced)\nnode mmx-monitor-server.js --allow-header-key\n\n# Disable /api/probe endpoint entirely (no inference calls)\nnode mmx-monitor-server.js --no-probe\n```\n\n---\n\n## Configuration\n\n### mmx Local Config (loaded on demand)\n\nThe backend **does not auto-read** `~/.mmx/config.json`. Use the dashboard's **\"加载本地凭证\"** button to explicitly load the API key into server process memory. The key is held only in memory (not written to disk, not returned in HTTP responses), and is cleared on server restart.\n\n### Environment Variable (fallback)\n\nIf `~/.mmx/config.json` is not present:\n\n```bash\n# Copy template\ncp .env.example .env\n\nMINIMAX_API_KEY=sk-cp-…here           # MiniMax API Key (Token Plan type)\n```\n\n---\n\n## Security & Data Flow\n\n**This service, by default, will**:\n\n1. **Load local credentials on demand** — Dashboard's \"加载本地凭证\" button triggers `POST /api/load_cred` which reads `~/.mmx/config.json` into server process memory (not browser, not disk). Server restart clears it. Endpoints requiring key return 401 until loaded.\n2. **Poll MiniMax API every 60s** — `https://www.minimaxi.com/v1/token_plan/remains` for quota data.\n3. **Write local usage samples** — `<skill-dir>/history.jsonl` is appended on each quota poll (24h ring buffer, contains usage percentages only, no credentials).\n4. **Run inference probe on user demand only** — Dashboard button + `confirm()` triggers `/api/probe` (5 chat completion requests, ~180 tokens).\n\n**This service will NOT**:\n\n- Auto-read `~/.mmx/config.json` on startup.\n- Return the API key in any HTTP response body.\n- Accept empty `Referer` for credential-loading requests.\n- Allow cross-origin web pages to reach the local server.\n- Run the inference probe automatically or on a timer.\n\n---\n\n## API Endpoints\n\n| Endpoint | Description |\n|----------|-------------|\n| `POST /api/load_cred` | Load API key from `~/.mmx/config.json` (user-clicks-button, confirm dialog required) |\n| `GET /api/token_plan` | Fetch quota from MiniMax official (requires loaded key) |\n| `GET /api/probe` | On-demand API latency probe (user-clicks-button, confirm dialog, requires loaded key) |\n| `GET /api/history?hours=24` | 24h usage history from local ring buffer |\n| `GET /health` | Health check |\n\n---\n\n## File Overview\n\n| File | Description |\n|------|-------------|\n| `mmx-monitor.html` | Monitoring page (single-file HTML frontend) |\n| `mmx-monitor-server.js` | Local proxy service (Node.js, port 9877) |\n| `history.jsonl` | 24h usage history ring buffer (auto-generated, gitignored) |\n| `SKILL.md` | Agent skill definition |\n| `CHANGELOG.md` | Full version history |\n| `demo.png` | Dashboard screenshot |\n| `LICENSE` | MIT License |\n\n---\n\n## FAQ\n\n**Q: Shows \"Connection Failed\" after clicking Query?**\nA: Make sure the backend service is running (`node mmx-monitor-server.js`).\n\n**Q: Port 9877 already in use?**\nA: Stop the process using that port, or modify the `PORT` constant in `mmx-monitor-server.js`.\n\n---\n\n## License\n\nMIT License — see [LICENSE](LICENSE).\n\nFile v1.6.5:_meta.json\n\n{\n  \"ownerId\": \"kn70zthc74p61mvctddrancx0s832g4r\",\n  \"slug\": \"minimax-monitor\",\n  \"version\": \"1.6.5\",\n  \"publishedAt\": 1782796704632\n}\n\nFile v1.6.5:CHANGELOG.md\n\n# Changelog\n\nAll notable changes to MiniMax Monitor will be documented in this file.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n\n## [1.6.3] - 2026-06-30\n\n### Security\n- 🐛 `/api/probe` 拒绝空 `Referer`（之前空 `Referer` 会被静默放行,绕过了本机 origin 二次确认 → curl/本机直连可直接触发真实 API 调用)\n- 🐛 加载本地凭证后,API key 不再写回 `input.value`（之前 key 进入 DOM,password 字段只是 UI 遮罩,肩窥/扩展/DevTools 仍可读）——现在只存内存变量,input 显示占位符,加 `data-loaded=\"1\"` 标记让「查询」按钮识别「已加载」状态不要覆盖\n\n## [1.6.2] - 2026-06-29\n\n### Security\n- 🐛 `/api/probe` 拒绝空 `Referer`（之前空 `Referer` 会被静默放行,绕过了本机 origin 二次确认 → curl/本机直连可直接触发真实 API 调用)\n- 🐛 加载本地凭证后,API key 不再写回 `input.value`（之前 key 进入 DOM,password 字段只是 UI 遮罩,肩窥/扩展/DevTools 仍可读）——现在只存内存变量,input 显示占位符,加 `data-loaded=\"1\"` 标记让「查询」按钮识别「已加载」状态不要覆盖\n\n### Documentation\n- 🧹 SKILL.md 删「## 更新日志」整段（v1.6.0/v1.5.0/v1.4.0/...）— ClawHub 全文渲染不再堆历史\n- 🧹 SKILL.md 删 Security 重复段 + 删冗余「技能简介 / 触发词收敛 / 文件说明 / 使用方式 / 环境变量 / 注意事项」段\n- 🧹 README.md / README_zh.md 重写 — 顶部「Current Version: v1.6.1」+「Features (v1.6.1)」只描述当前版本功能，不堆 Changelog 历史\n- 🧹 CHANGELOG.md 重写 — 保留累积变更（行业惯例），精简每版条目、去掉审计器 finding 编号等内部叙事噪音\n\n## [1.6.1] - 2026-06-29\n\n### Security\n- 🐛 `/api/load_cred` 响应不再返回完整 API key（只回 `keyLength` + `keyPrefix` 前 6 字符）\n- 🐛 `/api/load_cred` 拒绝空 `Referer`，强制本机白名单\n- 📝 SKILL.md frontmatter `permissions` 补 `write:filesystem`（声明 `history.jsonl` 写入）\n\n### Documentation\n- 🧹 清理 README 自相矛盾 — 所有\"自动读取 `~/.mmx/config.json`\"的旧表述统一改为\"按需主动加载\"叙事\n- 📝 SKILL.md Security 段重写 + 加 `history.jsonl` 持久化披露 + 操作风险提示\n- 📝 新增 CONTRIBUTING.md\n\n## [1.6.0] - 2026-06-26\n\n### Security Hardening\n- 🔒 凭证按需加载 — Server 启动不读 `~/.mmx/config.json`，仪表盘点 \"加载本地凭证\" 按钮 + confirm 才读\n- 🔒 删除浏览器 localStorage 24h 记忆 — 重启后必须重新输入或重新加载\n- 🔒 速率测试改按需 — 仪表盘速率面板不再自动调用 chat completion，需用户点 \"开始速率测试\" 按钮 + confirm\n- 🔒 删除飞书推送 — 飞书 OAuth 协议要求发 `FEISHU_APP_SECRET`，无法通过文档警示消除该风险\n\n### Other\n- 🛠 Server 直接服务 HTML（`http://127.0.0.1:9877/`），绕开 Safari `file://` fetch 报错\n- 📝 SKILL.md description 改为诚实版（\"套餐监控 + 速率测试\"双职责）\n\n## [1.5.1] - 2026-06-26\n\n### Changed\n- 🔒 触发词收敛为单一 `mmx 仪表盘启动`（从 4 个泛词收敛），降低误触概率\n- 🛑 飞书推送不再走对话触发\n\n## [1.5.0] - 2026-06-25\n\n### Features\n- 🆕 `/api/history` 端点（24h 滚动 buffer）— `history.jsonl` 记录用量快照，前端画趋势线\n- 🆕 主面板响应式高度（`min(560px, 100vh-150px)`）— 小屏笔记本不滚动\n- 🆕 双语 README — 英文 + 中文互相跳转\n\n## [1.4.0] - 2026-06-25\n\n### Security\n- 🔒 CORS 严格化 — `Access-Control-Allow-Origin` 改为 `127.0.0.1/localhost/file://` allowlist\n- 🔒 Header API key 默认拒绝（`--allow-header-key` 显式开启）\n- 🔒 `localStorage` 默认不自动加载（\"记住 24 小时\"勾选后才写）\n- 🔒 `--no-probe` flag 关闭速率测试端点\n- 📄 新增 Security & Data Flow 章节\n\n## [1.3.0] - 2026-06-24\n\n### Features\n- 🆕 视频模型\"套餐未启用\"识别（`status=3` 元数据无法区分真实无限额 vs 套餐未启用）\n- 🆕 套餐对比 banner（海螺视频卡片内嵌三档套餐升级面板）\n- 🆕 无周限账号识别（`current_weekly_status=3` 显示\"无周限\"）\n- 🆕 适配官方 Token Plan 新格式（`*_remaining_percent` 剩余百分比）\n- 🔧 端口 9876 → 9877（避让 minimax-embedding-adapter）\n\n### Bug Fixes\n- 🐛 大圆环 `dasharray` bug — 硬编码 515（= 2πr），实际半圆 πr ≈ 257.6\n- 🐛 流式响应解析错误 — SSE 多行格式 `parseJson` 整块失败\n\n## [1.2.0] - 2026-06-23\n\n### Features\n- 🆕 适配官方 Token Plan 新格式（同 v1.3.0）\n- 🆕 stat 数字加 % 后缀\n\n### Bug Fixes\n- 🐛 大圆环 `dasharray` bug（同 v1.3.0）\n\n## [1.1.0] - 2026-04-26\n\n### Features\n- 🆕 标签页自动刷新 — 切换回浏览器标签时触发一次配额和速率数据刷新\n\n## [1.0.0] - 2026-04-26\n\n### Initial Release\n- 实时配额仪表盘（5h 重置倒计时、模型明细、本周配额）\n- API 速率探针（SEQ-10 顺序、BURST-3 并发、TTFT、延迟、Tokens/s）\n- 飞书推送（可选）\n- 双层卡片布局（glass-card 玻璃质感）\n\n[1.6.2]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.6.1...v1.6.2\n[1.6.1]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.6.0...v1.6.1\n[1.6.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.5.1...v1.6.0\n[1.5.1]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.5.0...v1.5.1\n[1.5.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.4.0...v1.5.0\n[1.4.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.3.0...v1.4.0\n[1.3.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.2.0...v1.3.0\n[1.2.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.1.0...v1.2.0\n[1.1.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.0.0...v1.1.0\n\nFile v1.6.5:CONTRIBUTING.md\n\n# Contributing to `minimax-monitor`\n\nThank you for your interest in contributing! Please follow these steps to set up your development environment and submit changes.\n\n## Development Setup\n\n```bash\n# 1. Fork the repository on GitHub\n\n# 2. Clone your fork\ngit clone https://github.com/wangjipeng977/minimax-monitor.git\ncd minimax-monitor\n\n# 3. Install dependencies (none — pure Node.js stdlib, no npm install needed)\n\n# 4. Run the self-audit to verify quality\npython ~/.openclaw/workspace/skills/skill-factory/scripts/audit_skill.py . --hit-score\n```\n\n## Workflow\n\nWe use a standard feature branch workflow:\n\n```bash\n# 1. Create a new branch from main\ngit checkout -b feat/<your-feature-name>\n\n# 2. Make your changes\n#    - Follow the SKILL.md structure standards\n#    - Keep SKILL.md body in English\n#    - Do not hardcode API keys or secrets\n\n# 3. Run the audit to check for issues\npython scripts/audit_skill.py .\n\n# 4. Commit your changes\ngit add .\ngit commit -m \"feat(minimax-monitor): add <brief description>\"\n\n# 5. Push to your fork\ngit push origin feat/<your-feature-name>\n\n# 6. Open a Pull Request on GitHub\n#    - Title: feat(minimax-monitor): add <brief description>\n#    - Description: What + Why + Testing\n```\n\n## Code Standards\n\n- **SKILL.md**: Follow the YAML frontmatter standard (name, description, license, metadata)\n- **Scripts**: Must include shebang, requirements.txt, and graceful error handling\n- **Language**: SKILL.md body must be in English; reference docs in English\n- **No secrets**: Never commit API keys, tokens, or credentials\n\n## Quality Checklist\n\nBefore opening a PR, verify:\n\n- [ ] `audit_skill.py` exits with code 0 or 2\n- [ ] `validate_skills.py` exits with code 0\n- [ ] README.md and README_zh.md are both present\n- [ ] CONTRIBUTING.md is present\n- [ ] .gitignore is present\n- [ ] No hardcoded secrets anywhere in the codebase\n\n## Reporting Issues\n\nPlease report issues via GitHub Issues with:\n\n1. **What you expected to happen**\n2. **What actually happened**\n3. **Steps to reproduce**\n4. **Environment** (OS, Python version, etc.)\n\n## License\n\nBy contributing, you agree that your contributions will be licensed under the MIT License.\n\nFile v1.6.5:README_zh.md\n\n# MiniMax 套餐监控中心\n\n[English](./README.md)\n\n实时本地仪表盘，监控 MiniMax API 套餐使用情况，支持配额、按需速率测试、本周用量追踪、24 小时历史趋势。\n\n> **当前版本：v1.6.3** | [更新日志](CHANGELOG.md) | [许可证](LICENSE)\n\n![Dashboard](demo.png)\n\n![License](https://img.shields.io/badge/License-MIT-blue)\n\n---\n\n## v1.6.3 功能\n\n### 配额监控\n\n- 📊 **4 小时 / 24 小时 / 本周** 三档用量追踪 — 主圆环按用户当前 Token Plan 套餐的实际周期动态显示\n- 🎯 **模型卡片** 区分 4h 限额 / 24h 限额 / 周无限额 / 套餐未启用(视频模型 status=3 元数据不可区分时显示\"套餐未启用 · 不可调用\"提示并排除出 4h 聚合)\n- 📈 **24 小时趋势线** — 本地 `history.jsonl` 滚动 buffer 记录每次 `token_plan` 调用的用量快照\n\n### 速率测试(按需)\n\n- ⚡ **TTFT / P50 / 突发并发 / token·s** 四项指标,基于真实 chat completion 请求\n- ⚠️ **UI 红字 + confirm() 二次确认** — 每次测试消耗约 180 token,需用户主动确认,不点不动\n\n### 安全\n\n- 🔒 **本地凭证按需加载** — Server 启动**不读** `~/.mmx/config.json`。用户在仪表盘顶部点 \"加载本地凭证\" 按钮 + `confirm()` 二次确认后,才通过 `POST /api/load_cred` 读取 API key,存入 server 进程内存(不写磁盘、不写浏览器、不上传)\n- 🔒 **`/api/load_cred` 响应不含完整 API key** — 只回 `keyLength` + `keyPrefix`(前 6 字符,用于视觉确认 `sk-cp-` 前缀)\n- 🔒 **`/api/load_cred` 拒绝空 Referer** — 强制 `Referer` 是本机白名单 `127.0.0.1 / localhost / file://` 之一\n- 🔒 **CORS 严格** — `Access-Control-Allow-Origin` 仅放行 `127.0.0.1 / localhost / file://`\n- 🔒 **不向远程传输 key** — API key 永不离开本机\n\n---\n\n## 快速开始\n\n### 前置条件\n\n- Node.js ≥ 18\n\n### 运行\n\n```bash\n# 1. 启动后端服务\nnode mmx-monitor-server.js\n\n# 2. 打开浏览器(macOS 自动唤起 http://127.0.0.1:9877/)\nopen http://127.0.0.1:9877/\n# Windows / Linux: 手动访问 http://127.0.0.1:9877/\n```\n\n### 加载 API Key\n\n页面打开后,点击顶部 **\"加载本地凭证\"** 按钮 → 确认 → 从 `~/.mmx/config.json` 读取 key 存入 server 进程内存。或直接在输入框粘贴 key。\n\n---\n\n## 启动选项\n\n```bash\n# 默认\nnode mmx-monitor-server.js\n\n# 启用 X-MMX-API-Key header 透传(高级)\nnode mmx-monitor-server.js --allow-header-key\n\n# 关闭 /api/probe 端点(完全不发起推理调用)\nnode mmx-monitor-server.js --no-probe\n```\n\n---\n\n## 配置\n\n### mmx 本地配置(按需加载)\n\n后端服务**不**自动读取 `~/.mmx/config.json`。需要时点仪表盘顶部的 **\"加载本地凭证\"** 按钮,触发 `confirm()` 二次确认后才会调用 `POST /api/load_cred` 读取 API key,存入 server 进程内存(不写磁盘、不出现在 HTTP 响应里)。Server 重启后 key 丢失,需要重新点击按钮加载;未加载时所有需要 key 的端点返 401。\n\n### 环境变量(备选)\n\n如果 `~/.mmx/config.json` 不存在:\n\n```bash\n# 复制模板\ncp .env.example .env\n\nMINIMAX_API_KEY=sk-cp-…here           # MiniMax API Key(Token Plan 类型)\n```\n\n---\n\n## 安全与数据流\n\n**本服务默认会**:\n\n1. **按需加载本地凭证** — 仪表盘\"加载本地凭证\"按钮触发 `POST /api/load_cred`,从 `~/.mmx/config.json` 读取 API key 到 server 进程内存(不写浏览器 / 不写文件 / server 重启后丢失)。未加载时所有需要 key 的端点返 401。\n2. **每 60s 调 MiniMax API** — `https://www.minimaxi.com/v1/token_plan/remains` 拿配额数据。\n3. **写入本地用量采样** — 每次配额拉取后追加到 `<skill-dir>/history.jsonl`(24h 滚动 buffer,只含用量百分比,不含凭证)。\n4. **速率测试需用户主动触发** — 仪表盘按钮 + `confirm()` 才发起 5 次 chat completion 请求(约 180 token)。\n\n**本服务不会**:\n\n- 启动时自动读取 `~/.mmx/config.json`\n- 在任何 HTTP 响应中返回完整 API key\n- 接受空 Referer 调凭证加载端点\n- 允许跨源网页调用本机 server\n- 自动或定时运行速率测试\n\n---\n\n## API 端点\n\n| 端点 | 说明 |\n|------|------|\n| `POST /api/load_cred` | 从 `~/.mmx/config.json` 加载 API key(用户点按钮 + confirm) |\n| `GET /api/token_plan` | 从 MiniMax 官方拉取配额(需已加载 key) |\n| `GET /api/probe` | 按需 API 延迟探测(用户点按钮 + confirm,需已加载 key) |\n| `GET /api/history?hours=24` | 24h 用量历史(本地滚动 buffer) |\n| `GET /health` | 健康检查 |\n\n---\n\n## 文件说明\n\n| 文件 | 说明 |\n|------|------|\n| `mmx-monitor.html` | 监控页面(单文件 HTML 前端) |\n| `mmx-monitor-server.js` | 本地代理服务(Node.js,端口 9877) |\n| `history.jsonl` | 24h 用量历史滚动 buffer(自动生成,不入 git) |\n| `SKILL.md` | 技能定义 |\n| `CHANGELOG.md` | 完整版本历史 |\n| `demo.png` | 仪表盘截图 |\n| `LICENSE` | MIT 许可证 |\n\n---\n\n## 常见问题\n\n**Q: 点击查询后提示\"连接失败\"?**\nA: 确认后端服务在跑(`node mmx-monitor-server.js`)。\n\n**Q: 端口 9877 被占用?**\nA: 停掉占用该端口的进程,或修改 `mmx-monitor-server.js` 中的 `PORT` 常量。\n\n---\n\n## 许可证\n\nMIT License — 见 [LICENSE](LICENSE)。\n\nFile v1.6.5:skill-card.md\n\n## Description: <br>\nMinimax Monitor launches a local dashboard for MiniMax Token Plan quota tracking, 24-hour usage history, and user-initiated inference latency checks. <br>\n\nThis skill is ready for commercial/non-commercial use. <br>\n\n## Publisher: <br>\n[wangjipeng977](https://clawhub.ai/user/wangjipeng977) <br>\n\n### License/Terms of Use: <br>\nMIT-0 <br>\n\n\n## Use Case: <br>\nDevelopers and MiniMax API users use this skill to start a local monitoring dashboard, load a MiniMax API key on demand, inspect quota windows, review recent usage samples, and optionally run a latency probe. <br>\n\n### Deployment Geography for Use: <br>\nGlobal <br>\n\n## Known Risks and Mitigations: <br>\nRisk: The local MiniMax proxy can perform credential-backed actions after an API key is loaded. <br>\nMitigation: Use it only on a trusted local machine, keep port 9877 private, and stop the server when monitoring is no longer needed. <br>\nRisk: The latency probe sends real MiniMax chat completion requests and can consume quota. <br>\nMitigation: Run probes only when the user explicitly wants a rate test and avoid repeated clicks. <br>\nRisk: The release evidence says the documented --no-probe disable option should not be treated as available in this artifact unless the code is fixed. <br>\nMitigation: Do not rely on --no-probe for risk control; avoid using the probe path or update the server implementation before depending on that option. <br>\n\n\n## Reference(s): <br>\n- [ClawHub skill page](https://clawhub.ai/wangjipeng977/skills/minimax-monitor) <br>\n- [Publisher profile](https://clawhub.ai/user/wangjipeng977) <br>\n- [Metadata source](https://github.com/MiniMax-AI/skills) <br>\n- [MiniMax token plan API endpoint](https://www.minimaxi.com/v1/token_plan/remains) <br>\n\n\n## Skill Output: <br>\n**Output Type(s):** [shell commands, configuration, guidance, text] <br>\n**Output Format:** [Markdown guidance with inline shell commands and local dashboard output] <br>\n**Output Parameters:** [1D] <br>\n**Other Properties Related to Output:** [Starts a local Node.js service on port 9877 and may create a local history.jsonl usage-sample file.] <br>\n\n## Skill Version(s): <br>\n1.6.5 (source: server release metadata and SKILL.md metadata; artifact README and CHANGELOG mention 1.6.3) <br>\n\n## Ethical Considerations: <br>\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment. <br>\n\nArchive v1.6.4: 9 files, 34111 bytes\n\nFiles: CHANGELOG.md (6045b), CONTRIBUTING.md (2173b), mmx-monitor-server.js (23085b), mmx-monitor.html (32620b), README_zh.md (5292b), README.md (5228b), skill-card.md (2643b), SKILL.md (9841b), _meta.json (134b)\n\nFile v1.6.4:SKILL.md\n\n---\nname: minimax-monitor\ndescription: >\n  Use when (1) user says \"mmx 仪表盘启动\" / \"mmx monitor\" / \"MiniMax 配额查询\" / \"打开 minimax 监控\" and wants a real-time dashboard.\n  (2) user wants to check how much of their MiniMax Token Plan quota is left (4h / 24h / weekly windows for M3 / M2.7 / video / music / image models).\n  (3) user wants to test MiniMax inference latency (TTFT / P50 / burst) by clicking \"开始速率测试\" - explicitly opt-in, NOT background.\nlicense: MIT\nmetadata:\n  version: \"1.6.3\"\n  category: dev-tools\n  author: wangjipeng\n  sources:\n    - https://github.com/MiniMax-AI/skills\npermissions:\n  - read:filesystem       # ~/.mmx/config.json\n  - write:filesystem      # history.jsonl (24h ring buffer, 本技能目录)\n  - read:env               # MINIMAX_API_KEY\n  - network:outbound       # api.minimaxi.com / www.minimaxi.com\n  - shell:exec             # 'open' 命令启动浏览器\n---\n\n# MiniMax 套餐监控 + 速率测试中心\n\n> **触发词**:mmx 仪表盘启动\n>\n> **两个职责**:\n> 1. **实时配额查询** -- 60s 轮询官方 token_plan API,显示 4h / 24h / 本周用量、模型卡片、24h 趋势。\n> 2. **按需速率测试** -- 用户点 \"开始速率测试\" 按钮才发起 5 次 chat completion 请求(约 180 token 上限),返回 TTFT / P50 / burst / token-s。\n>\n> 启动后自动用 `open` 命令唤起浏览器打开 `http://127.0.0.1:9877/`。\n\n## v1.6.3 主要功能\n\n### 安全\n\n- 🔒 **本地凭证按需加载**。Server 启动**不读** `~/.mmx/config.json`。用户在仪表盘顶部点 \"加载本地凭证\" 按钮 + `confirm()` 二次确认后,才通过 `POST /api/load_cred` 读取 API key,存入 server 进程内存(不写磁盘、不写浏览器、不上传)。Server 重启后 key 丢失。\n- 🔒 **`/api/load_cred` 响应不含完整 API key**(只回 `keyLength` + `keyPrefix` 前 6 字符用于视觉确认)。\n- 🔒 **`/api/load_cred` 拒绝空 Referer**,强制 `Referer` 是本机白名单 `127.0.0.1 / localhost / file://` 之一。\n- 🔒 **CORS 严格**:`Access-Control-Allow-Origin` 仅放行 `127.0.0.1 / localhost / file://`。恶意网页无法跨域调本机 server 消耗你的 MiniMax 配额。\n- 🔒 **速率测试按需**:`/api/probe` 不再后台定时调用。仅在用户点 \"开始速率测试\" 按钮时才发起 5 次 chat completion,UI 红字提示 + 二次确认。\n\n### 配额监控\n\n- 📊 **4 小时 / 24 小时 / 本周** 三档用量追踪(4 小时为主圆环,按用户当前 Token Plan 套餐的实际周期动态显示)。\n- 🎯 **模型卡片** 区分 4h 限额 / 24h 限额 / 周无限额 / 套餐未启用(视频模型 status=3 元数据不可区分时显示 \"套餐未启用 · 不可调用\" 提示并排除出 4h 聚合)。\n- 📈 **24 小时趋势线**:`history.jsonl` 滚动 buffer(本技能目录)记录每次 `token_plan` 调用的用量快照,前端画趋势线。\n\n### 速率测试\n\n- ⚡ **TTFT / P50 / 突发并发 / token·s** 四项指标,基于真实 chat completion 请求。\n- ⚠️ **UI 红字 + confirm()** 提示每次测试消耗约 180 token,需用户主动确认。\n\n### 启动\n\n```bash\nnode ~/.openclaw/workspace/skills/minimax-monitor/mmx-monitor-server.js\n# 浏览器访问 http://127.0.0.1:9877/\n```\n\n高级选项:\n\n```bash\n# 启用 X-MMX-API-Key header 透传(默认拒绝)\nnode mmx-monitor-server.js --allow-header-key\n# 完全关闭速率测试端点\nnode mmx-monitor-server.js --no-probe\n```\n\n## Security & Data Flow\n\n本技能默认会:\n\n1. **读取本地凭证(按需)**:从 `~/.mmx/config.json` 读取 `api_key`(MiniMax Token Plan key)。**仅在用户主动点击 \"加载本地凭证\" 按钮时才会读**(`POST /api/load_cred`),server 启动时**不**读。读到的 key 存 server 进程内存,不写盘、不上传,server 重启后清空。\n2. **定时调用 MiniMax API**:每 60s 调 `https://www.minimaxi.com/v1/token_plan/remains` 拿配额数据。\n3. **写入本地采样数据**:每次 `fetchQuota` 后向 `<skill-dir>/history.jsonl` 追加一行 `(timestamp, usedPct, modelSnapshot)`,保留最近 24h 滚动 buffer,供前端画趋势线。不存凭证、不存个人信息。\n4. **速率测试需用户主动触发**:v1.6.0 起,仪表盘速率面板**不再自动**调用 chat completion。点 \"开始速率测试\" 按钮才会发起 5 次真实 chat 请求(约 180 token 上限),UI 会有红字提示 + 二次确认。\n\n**不会做**:\n\n- 不会把 API key 上传到任何远程(仅本地使用)。\n- 不会在 `load_cred` 响应里返回 key。\n- 不会允许跨源网页调用本机 server(CORS allowlist 限定 `127.0.0.1 / localhost / file://`)。\n- 不会接受空 Referer 调 `load_cred`(强制本机页面发起的请求才放行)。\n- 不会在后台悄悄消耗你的 chat 配额(v1.6.0 起 probe 改按需触发;不点不动)。\n\n**操作风险提示**:\n\n- **本地凭证访问**:点击 \"加载本地凭证\" 按钮会读取 `~/.mmx/config.json` 的 `api_key`,并把 key 存入本机 server 进程内存。建议:仅在本机使用本技能,不要把 9877 端口对外暴露。\n- **持续出站轮询**:每 60s 一次的 `token_plan/remains` 调用会持续消耗 MiniMax 配额查询额度(Token Plan 套餐内免费)。如果不需要实时面板,可手动 `Ctrl+C` 停 server。\n- **本地历史文件**:`history.jsonl` 包含时间序列的用量百分比,**不包含**凭证或个人身份信息;不慎泄漏也只是用量趋势。\n\n**想使用 header 透传 key**(高级用户,需要自负责):`node mmx-monitor-server.js --allow-header-key`\n\n---\n\n## Modes\n\n### `dashboard` (default)\nReal-time token-plan quota monitor. Server polls `https://www.minimaxi.com/v1/token_plan/remains` every 60s after credentials are loaded. Renders ring chart, per-model cards, and 24h trend line. **This is what runs by default when the user says \"mmx 仪表盘启动\".**\n\n### `probe` (opt-in)\nOn-demand inference latency test. Triggered **only** by the dashboard button \"开始速率测试\" - never by timer. Runs 5 chat completions against `api.minimaxi.com/v1/text/chatcompletion_v2` (model `MiniMax-M2.7`, max_tokens=30-60, mix of streaming/non-streaming). Returns TTFT, P50, burst, token/s metrics. **Costs ~180 tokens per click; UI shows red warning + confirm() dialog before firing.**\n\n### `history` (read-only)\nReads `history.jsonl` (24h ring buffer at `<skill-dir>/history.jsonl`) and returns time-series usage samples via `GET /api/history?hours=24`. No writes. Used by the dashboard's trend line widget.\n\n---\n\n## Do not\n\n- ❌ **Do not** auto-read `~/.mmx/config.json` on server startup. The credential is loaded **only** when the user explicitly clicks \"加载本地凭证\" (v1.6.0+).\n- ❌ **Do not** return the API key in any HTTP response body. `POST /api/load_cred` returns `keyLength` + `keyPrefix` only (v1.6.1+).\n- ❌ **Do not** accept empty `Referer` on `/api/load_cred`. Curl / CLI calls must include `-H 'Referer: http://127.0.0.1:9877/'` (v1.6.1+).\n- ❌ **Do not** run the inference probe in the background or on a timer. Probe is button-only, confirm-required, ~180 token cost per click (v1.6.0+).\n- ❌ **Do not** allow cross-origin web pages to reach the local server. CORS allowlist is `127.0.0.1 / localhost / file://` only (v1.4.0+).\n- ❌ **Do not** claim \"auto-read\" in any documentation. The only consistent narrative is \"on-demand, user-initiated, in-memory only\".\n\n---\n\n## Good vs. Bad Examples\n\n| Scenario | ❌ Bad (v1.5.x and earlier) | ✅ Good (v1.6.1+) |\n|----------|---------------------------|------------------|\n| Server startup | Reads `~/.mmx/config.json` silently; loads key into memory at boot | Reads nothing; `credLoadedKey = ''`; waits for user click |\n| User opens dashboard | Key is already in server, all panels work | All panels show 401; user clicks \"加载本地凭证\" → confirm → key loads |\n| `POST /api/load_cred` response | `{\"ok\":true, \"key\":\"sk-cp-...real-key-here...\"}` | `{\"ok\":true, \"keyLength\":125, \"keyPrefix\":\"sk-cp-\"}` |\n| curl `load_cred` with no headers | `{\"ok\":true, \"key\":\"...\"}` (key leaked) | `403 {\"ok\":false, \"error\":\"requires Referer from local origin\"}` |\n| Probe behavior | Background timer fires every 5 min, silently consumes quota | Button only; red warning + confirm() before firing; no background calls |\n| README \"Configuration\" section header | `### mmx Local Config (auto-read, recommended)` | `### mmx Local Config (loaded on demand, v1.6.0+)` |\n| Frontend localStorage | Key persisted 24h via \"Remember\" toggle | No localStorage; user re-pastes key per session |\n\n---\n\n## Quality Bar\n\nA **good** v1.6.1+ deploy of this skill satisfies:\n\n- ✅ Server starts and listens on port 9877 without reading any local credentials (verify with `pgrep -fl mmx-monitor` then `lsof -p <pid> -P -n` shows no `~/.mmx/config.json` open).\n- ✅ Empty-Refefer `POST /api/load_cred` returns 403, not 200.\n- ✅ Valid-Refefer `POST /api/load_cred` returns 200 with `key` field absent (only `keyLength` + `keyPrefix`).\n- ✅ `GET /api/token_plan` returns 401 with `{\"error\":\"API key 未加载...\"}` before any user action, and 200 with valid quota data after credential load.\n- ✅ `<skill-dir>/history.jsonl` is created on first `token_plan` poll and is mentioned in `SKILL.md` Security section + this file.\n- ✅ `SKILL.md` frontmatter `permissions:` lists `write:filesystem` (not just `read:filesystem`).\n- ✅ No \"auto-read\" wording remains in `README.md` / `README_zh.md` / `SKILL.md` after v1.6.1 changes.\n- ✅ ClawHub security audit finding count for this skill drops from 13 → ≤ 3 after v1.6.1 publish.\n\nA **bad** deploy:\n\n- ❌ `key` field still in `load_cred` response (regression to v1.6.0 bug).\n- ❌ `permissions:` missing `write:filesystem` (regression to v1.5.x).\n- ❌ README still says \"auto-read\" anywhere (audit trigger).\n- ❌ Empty-Refefer `load_cred` returns 200 (regression).\n\nFile v1.6.4:README.md\n\n# MiniMax Package Monitor\n\n[中文版](./README_zh.md)\n\nReal-time local dashboard for monitoring MiniMax API package usage — quota tracking, on-demand rate probing, weekly usage, and 24h history.\n\n> **Current Version: v1.6.3** | [CHANGELOG](CHANGELOG.md) | [License](LICENSE)\n\n![Dashboard](demo.png)\n\n![License](https://img.shields.io/badge/License-MIT-blue)\n\n---\n\n## Features (v1.6.3)\n\n### Quota Monitoring\n\n- 📊 **4-hour / 24-hour / weekly** usage windows — primary ring chart shows the user's actual Token Plan cycle\n- 🎯 **Per-model cards** distinguish 4h-capped / 24h-capped / no-weekly-limit / plan-not-enabled (video) cases\n- 📈 **24-hour trend line** from local `history.jsonl` ring buffer\n\n### Rate Probing (on-demand)\n\n- ⚡ **TTFT / P50 / burst / token·s** measurements from real chat completion requests\n- ⚠️ **Button-only with confirm() dialog** — costs ~180 tokens per click, never fires automatically\n\n### Security\n\n- 🔒 **Credential loaded on demand** — Server does **not** auto-read `~/.mmx/config.json`. Dashboard's \"加载本地凭证\" button + `confirm()` triggers `POST /api/load_cred`, key stored in server process memory only\n- 🔒 **`/api/load_cred` response excludes the full key** — returns `keyLength` + `keyPrefix` (first 6 chars) only\n- 🔒 **`/api/load_cred` rejects empty `Referer`** — must come from a local-origin page (`127.0.0.1 / localhost / file://`)\n- 🔒 **CORS allowlist** — only `127.0.0.1 / localhost / file://` can reach the local server\n- 🔒 **No remote key transmission** — API key never leaves the local machine\n\n---\n\n## Quick Start\n\n### Prerequisites\n\n- Node.js ≥ 18\n\n### Run\n\n```bash\n# 1. Start backend service\nnode mmx-monitor-server.js\n\n# 2. Open browser (macOS auto-opens http://127.0.0.1:9877/)\nopen http://127.0.0.1:9877/\n# Windows / Linux: navigate to http://127.0.0.1:9877/ manually\n```\n\n### Load API Key\n\nAfter the page loads, click **\"加载本地凭证\"** button → confirm → key loads from `~/.mmx/config.json` into server process memory. Or paste your key directly into the input box.\n\n---\n\n## Startup Options\n\n```bash\n# Default\nnode mmx-monitor-server.js\n\n# Enable X-MMX-API-Key header passthrough (advanced)\nnode mmx-monitor-server.js --allow-header-key\n\n# Disable /api/probe endpoint entirely (no inference calls)\nnode mmx-monitor-server.js --no-probe\n```\n\n---\n\n## Configuration\n\n### mmx Local Config (loaded on demand)\n\nThe backend **does not auto-read** `~/.mmx/config.json`. Use the dashboard's **\"加载本地凭证\"** button to explicitly load the API key into server process memory. The key is held only in memory (not written to disk, not returned in HTTP responses), and is cleared on server restart.\n\n### Environment Variable (fallback)\n\nIf `~/.mmx/config.json` is not present:\n\n```bash\n# Copy template\ncp .env.example .env\n\nMINIMAX_API_KEY=sk-cp-…here           # MiniMax API Key (Token Plan type)\n```\n\n---\n\n## Security & Data Flow\n\n**This service, by default, will**:\n\n1. **Load local credentials on demand** — Dashboard's \"加载本地凭证\" button triggers `POST /api/load_cred` which reads `~/.mmx/config.json` into server process memory (not browser, not disk). Server restart clears it. Endpoints requiring key return 401 until loaded.\n2. **Poll MiniMax API every 60s** — `https://www.minimaxi.com/v1/token_plan/remains` for quota data.\n3. **Write local usage samples** — `<skill-dir>/history.jsonl` is appended on each quota poll (24h ring buffer, contains usage percentages only, no credentials).\n4. **Run inference probe on user demand only** — Dashboard button + `confirm()` triggers `/api/probe` (5 chat completion requests, ~180 tokens).\n\n**This service will NOT**:\n\n- Auto-read `~/.mmx/config.json` on startup.\n- Return the API key in any HTTP response body.\n- Accept empty `Referer` for credential-loading requests.\n- Allow cross-origin web pages to reach the local server.\n- Run the inference probe automatically or on a timer.\n\n---\n\n## API Endpoints\n\n| Endpoint | Description |\n|----------|-------------|\n| `POST /api/load_cred` | Load API key from `~/.mmx/config.json` (user-clicks-button, confirm dialog required) |\n| `GET /api/token_plan` | Fetch quota from MiniMax official (requires loaded key) |\n| `GET /api/probe` | On-demand API latency probe (user-clicks-button, confirm dialog, requires loaded key) |\n| `GET /api/history?hours=24` | 24h usage history from local ring buffer |\n| `GET /health` | Health check |\n\n---\n\n## File Overview\n\n| File | Description |\n|------|-------------|\n| `mmx-monitor.html` | Monitoring page (single-file HTML frontend) |\n| `mmx-monitor-server.js` | Local proxy service (Node.js, port 9877) |\n| `history.jsonl` | 24h usage history ring buffer (auto-generated, gitignored) |\n| `SKILL.md` | Agent skill definition |\n| `CHANGELOG.md` | Full version history |\n| `demo.png` | Dashboard screenshot |\n| `LICENSE` | MIT License |\n\n---\n\n## FAQ\n\n**Q: Shows \"Connection Failed\" after clicking Query?**\nA: Make sure the backend service is running (`node mmx-monitor-server.js`).\n\n**Q: Port 9877 already in use?**\nA: Stop the process using that port, or modify the `PORT` constant in `mmx-monitor-server.js`.\n\n---\n\n## License\n\nMIT License — see [LICENSE](LICENSE).\n\nFile v1.6.4:_meta.json\n\n{\n  \"ownerId\": \"kn70zthc74p61mvctddrancx0s832g4r\",\n  \"slug\": \"minimax-monitor\",\n  \"version\": \"1.6.4\",\n  \"publishedAt\": 1782796665017\n}\n\nFile v1.6.4:CHANGELOG.md\n\n# Changelog\n\nAll notable changes to MiniMax Monitor will be documented in this file.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n\n## [1.6.3] - 2026-06-30\n\n### Security\n- 🐛 `/api/probe` 拒绝空 `Referer`（之前空 `Referer` 会被静默放行,绕过了本机 origin 二次确认 → curl/本机直连可直接触发真实 API 调用)\n- 🐛 加载本地凭证后,API key 不再写回 `input.value`（之前 key 进入 DOM,password 字段只是 UI 遮罩,肩窥/扩展/DevTools 仍可读）——现在只存内存变量,input 显示占位符,加 `data-loaded=\"1\"` 标记让「查询」按钮识别「已加载」状态不要覆盖\n\n## [1.6.2] - 2026-06-29\n\n### Security\n- 🐛 `/api/probe` 拒绝空 `Referer`（之前空 `Referer` 会被静默放行,绕过了本机 origin 二次确认 → curl/本机直连可直接触发真实 API 调用)\n- 🐛 加载本地凭证后,API key 不再写回 `input.value`（之前 key 进入 DOM,password 字段只是 UI 遮罩,肩窥/扩展/DevTools 仍可读）——现在只存内存变量,input 显示占位符,加 `data-loaded=\"1\"` 标记让「查询」按钮识别「已加载」状态不要覆盖\n\n### Documentation\n- 🧹 SKILL.md 删「## 更新日志」整段（v1.6.0/v1.5.0/v1.4.0/...）— ClawHub 全文渲染不再堆历史\n- 🧹 SKILL.md 删 Security 重复段 + 删冗余「技能简介 / 触发词收敛 / 文件说明 / 使用方式 / 环境变量 / 注意事项」段\n- 🧹 README.md / README_zh.md 重写 — 顶部「Current Version: v1.6.1」+「Features (v1.6.1)」只描述当前版本功能，不堆 Changelog 历史\n- 🧹 CHANGELOG.md 重写 — 保留累积变更（行业惯例），精简每版条目、去掉审计器 finding 编号等内部叙事噪音\n\n## [1.6.1] - 2026-06-29\n\n### Security\n- 🐛 `/api/load_cred` 响应不再返回完整 API key（只回 `keyLength` + `keyPrefix` 前 6 字符）\n- 🐛 `/api/load_cred` 拒绝空 `Referer`，强制本机白名单\n- 📝 SKILL.md frontmatter `permissions` 补 `write:filesystem`（声明 `history.jsonl` 写入）\n\n### Documentation\n- 🧹 清理 README 自相矛盾 — 所有\"自动读取 `~/.mmx/config.json`\"的旧表述统一改为\"按需主动加载\"叙事\n- 📝 SKILL.md Security 段重写 + 加 `history.jsonl` 持久化披露 + 操作风险提示\n- 📝 新增 CONTRIBUTING.md\n\n## [1.6.0] - 2026-06-26\n\n### Security Hardening\n- 🔒 凭证按需加载 — Server 启动不读 `~/.mmx/config.json`，仪表盘点 \"加载本地凭证\" 按钮 + confirm 才读\n- 🔒 删除浏览器 localStorage 24h 记忆 — 重启后必须重新输入或重新加载\n- 🔒 速率测试改按需 — 仪表盘速率面板不再自动调用 chat completion，需用户点 \"开始速率测试\" 按钮 + confirm\n- 🔒 删除飞书推送 — 飞书 OAuth 协议要求发 `FEISHU_APP_SECRET`，无法通过文档警示消除该风险\n\n### Other\n- 🛠 Server 直接服务 HTML（`http://127.0.0.1:9877/`），绕开 Safari `file://` fetch 报错\n- 📝 SKILL.md description 改为诚实版（\"套餐监控 + 速率测试\"双职责）\n\n## [1.5.1] - 2026-06-26\n\n### Changed\n- 🔒 触发词收敛为单一 `mmx 仪表盘启动`（从 4 个泛词收敛），降低误触概率\n- 🛑 飞书推送不再走对话触发\n\n## [1.5.0] - 2026-06-25\n\n### Features\n- 🆕 `/api/history` 端点（24h 滚动 buffer）— `history.jsonl` 记录用量快照，前端画趋势线\n- 🆕 主面板响应式高度（`min(560px, 100vh-150px)`）— 小屏笔记本不滚动\n- 🆕 双语 README — 英文 + 中文互相跳转\n\n## [1.4.0] - 2026-06-25\n\n### Security\n- 🔒 CORS 严格化 — `Access-Control-Allow-Origin` 改为 `127.0.0.1/localhost/file://` allowlist\n- 🔒 Header API key 默认拒绝（`--allow-header-key` 显式开启）\n- 🔒 `localStorage` 默认不自动加载（\"记住 24 小时\"勾选后才写）\n- 🔒 `--no-probe` flag 关闭速率测试端点\n- 📄 新增 Security & Data Flow 章节\n\n## [1.3.0] - 2026-06-24\n\n### Features\n- 🆕 视频模型\"套餐未启用\"识别（`status=3` 元数据无法区分真实无限额 vs 套餐未启用）\n- 🆕 套餐对比 banner（海螺视频卡片内嵌三档套餐升级面板）\n- 🆕 无周限账号识别（`current_weekly_status=3` 显示\"无周限\"）\n- 🆕 适配官方 Token Plan 新格式（`*_remaining_percent` 剩余百分比）\n- 🔧 端口 9876 → 9877（避让 minimax-embedding-adapter）\n\n### Bug Fixes\n- 🐛 大圆环 `dasharray` bug — 硬编码 515（= 2πr），实际半圆 πr ≈ 257.6\n- 🐛 流式响应解析错误 — SSE 多行格式 `parseJson` 整块失败\n\n## [1.2.0] - 2026-06-23\n\n### Features\n- 🆕 适配官方 Token Plan 新格式（同 v1.3.0）\n- 🆕 stat 数字加 % 后缀\n\n### Bug Fixes\n- 🐛 大圆环 `dasharray` bug（同 v1.3.0）\n\n## [1.1.0] - 2026-04-26\n\n### Features\n- 🆕 标签页自动刷新 — 切换回浏览器标签时触发一次配额和速率数据刷新\n\n## [1.0.0] - 2026-04-26\n\n### Initial Release\n- 实时配额仪表盘（5h 重置倒计时、模型明细、本周配额）\n- API 速率探针（SEQ-10 顺序、BURST-3 并发、TTFT、延迟、Tokens/s）\n- 飞书推送（可选）\n- 双层卡片布局（glass-card 玻璃质感）\n\n[1.6.2]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.6.1...v1.6.2\n[1.6.1]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.6.0...v1.6.1\n[1.6.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.5.1...v1.6.0\n[1.5.1]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.5.0...v1.5.1\n[1.5.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.4.0...v1.5.0\n[1.4.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.3.0...v1.4.0\n[1.3.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.2.0...v1.3.0\n[1.2.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.1.0...v1.2.0\n[1.1.0]: https://github.com/Wangjipeng977/minimax-monitor/compare/v1.0.0...v1.1.0\n\nFile v1.6.4:CONTRIBUTING.md\n\n# Contributing to `minimax-monitor`\n\nThank you for your interest in contributing! Please follow these steps to set up your development environment and submit changes.\n\n## Development Setup\n\n```bash\n# 1. Fork the repository on GitHub\n\n# 2. Clone your fork\ngit clone https://github.com/wangjipeng977/minimax-monitor.git\ncd minimax-monitor\n\n# 3. Install dependencies (none — pure Node.js stdlib, no npm install needed)\n\n# 4. Run the self-audit to verify quality\npython ~/.openclaw/workspace/skills/skill-factory/scripts/audit_skill.py . --hit-score\n```\n\n## Workflow\n\nWe use a standard feature branch workflow:\n\n```bash\n# 1. Create a new branch from main\ngit checkout -b feat/<your-feature-name>\n\n# 2. Make your changes\n#    - Follow the SKILL.md structure standards\n#    - Keep SKILL.md body in English\n#    - Do not hardcode API keys or secrets\n\n# 3. Run the audit to check for issues\npython scripts/audit_skill.py .\n\n# 4. Commit your changes\ngit add .\ngit commit -m \"feat(minimax-monitor): add <brief description>\"\n\n# 5. Push to your fork\ngit push origin feat/<your-feature-name>\n\n# 6. Open a Pull Request on GitHub\n#    - Title: feat(minimax-monitor): add <brief description>\n#    - Description: What + Why + Testing\n```\n\n## Code Standards\n\n- **SKILL.md**: Follow the YAML frontmatter standard (name, description, license, metadata)\n- **Scripts**: Must include shebang, requirements.txt, and graceful error handling\n- **Language**: SKILL.md body must be in English; reference docs in English\n- **No secrets**: Never commit API keys, tokens, or credentials\n\n## Quality Checklist\n\nBefore opening a PR, verify:\n\n- [ ] `audit_skill.py` exits with code 0 or 2\n- [ ] `validate_skills.py` exits with code 0\n- [ ] README.md and README_zh.md are both present\n- [ ] CONTRIBUTING.md is present\n- [ ] .gitignore is present\n- [ ] No hardcoded secrets anywhere in the codebase\n\n## Reporting Issues\n\nPlease report issues via GitHub Issues with:\n\n1. **What you expected to happen**\n2. **What actually happened**\n3. **Steps to reproduce**\n4. **Environment** (OS, Python version, etc.)\n\n## License\n\nBy contributing, you agree that your contributions will be licensed under the MIT License.\n\nFile v1.6.4:README_zh.md\n\n# MiniMax 套餐监控中心\n\n[English](./README.md)\n\n实时本地仪表盘，监控 MiniMax API 套餐使用情况，支持配额、按需速率测试、本周用量追踪、24 小时历史趋势。\n\n> **当前版本：v1.6.3** | [更新日志](CHANGELOG.md) | [许可证](LICENSE)\n\n![Dashboard](demo.png)\n\n![License](https://img.shields.io/badge/License-MIT-blue)\n\n---\n\n## v1.6.3 功能\n\n### 配额监控\n\n- 📊 **4 小时 / 24 小时 / 本周** 三档用量追踪 — 主圆环按用户当前 Token Plan 套餐的实际周期动态显示\n- 🎯 **模型卡片** 区分 4h 限额 / 24h 限额 / 周无限额 / 套餐未启用(视频模型 status=3 元数据不可区分时显示\"套餐未启用 · 不可调用\"提示并排除出 4h 聚合)\n- 📈 **24 小时趋势线** — 本地 `history.jsonl` 滚动 buffer 记录每次 `token_plan` 调用的用量快照\n\n### 速率测试(按需)\n\n- ⚡ **TTFT / P50 / 突发并发 / token·s** 四项指标,基于真实 chat completion 请求\n- ⚠️ **UI 红字 + confirm() 二次确认** — 每次测试消耗约 180 token,需用户主动确认,不点不动\n\n### 安全\n\n- 🔒 **本地凭证按需加载** — Server 启动**不读** `~/.mmx/config.json`。用户在仪表盘顶部点 \"加载本地凭证\" 按钮 + `confirm()` 二次确认后,才通过 `POST /api/load_cred` 读取 API key,存入 server 进程内存(不写磁盘、不写浏览器、不上传)\n- 🔒 **`/api/load_cred` 响应不含完整 API key** — 只回 `keyLength` + `keyPrefix`(前 6 字符,用于视觉确认 `sk-cp-` 前缀)\n- 🔒 **`/api/load_cred` 拒绝空 Referer** — 强制 `Referer` 是本机白名单 `127.0.0.1 / localhost / file://` 之一\n- 🔒 **CORS 严格** — `Access-Control-Allow-Origin` 仅放行 `127.0.0.1 / localhost / file://`\n- 🔒 **不向远程传输 key** — API key 永不离开本机\n\n---\n\n## 快速开始\n\n### 前置条件\n\n- Node.js ≥ 18\n\n### 运行\n\n```bash\n# 1. 启动后端服务\nnode mmx-monitor-server.js\n\n# 2. 打开浏览器(macOS 自动唤起 http://127.0.0.1:9877/)\nopen http://127.0.0.1:9877/\n# Windows / Linux: 手动访问 http://127.0.0.1:9877/\n```\n\n### 加载 API Key\n\n页面打开后,点击顶部 **\"加载本地凭证\"** 按钮 → 确认 → 从 `~/.mmx/config.json` 读取 key 存入 server 进程内存。或直接在输入框粘贴 key。\n\n---\n\n## 启动选项\n\n```bash\n# 默认\nnode mmx-monitor-server.js\n\n# 启用 X-MMX-API-Key header 透传(高级)\nnode mmx-monitor-server.js --allow-header-key\n\n# 关闭 /api/probe 端点(完全不发起推理调用)\nnode mmx-monitor-server.js --no-probe\n```\n\n---\n\n## 配置\n\n### mmx 本地配置(按需加载)\n\n后端服务**不**自动读取 `~/.mmx/config.json`。需要时点仪表盘顶部的 **\"加载本地凭证\"** 按钮,触发 `confirm()` 二次确认后才会调用 `POST /api/load_cred` 读取 API key,存入 server 进程内存(不写磁盘、不出现在 HTTP 响应里)。Server 重启后 key 丢失,需要重新点击按钮加载;未加载时所有需要 key 的端点返 401。\n\n### 环境变量(备选)\n\n如果 `~/.mmx/config.json` 不存在:\n\n```bash\n# 复制模板\ncp .env.example .env\n\nMINIMAX_API_KEY=sk-cp-…here           # MiniMax API Key(Token Plan 类型)\n```\n\n---\n\n## 安全与数据流\n\n**本服务默认会**:\n\n1. **按需加载本地凭证** — 仪表盘\"加载本地凭证\"按钮触发 `POST /api/load_cred`,从 `~/.mmx/config.json` 读取 API key 到 server 进程内存(不写浏览器 / 不写文件 / server 重启后丢失)。未加载时所有需要 key 的端点返 401。\n2. **每 60s 调 MiniMax API** — `https://www.minimaxi.com/v1/token_plan/remains` 拿配额数据。\n3. **写入本地用量采样** — 每次配额拉取后追加到 `<skill-dir>/history.jsonl`(24h 滚动 buffer,只含用量百分比,不含凭证)。\n4. **速率测试需用户主动触发** — 仪表盘按钮 + `confirm()` 才发起 5 次 chat completion 请求(约 180 token)。\n\n**本服务不会**:\n\n- 启动时自动读取 `~/.mmx/config.json`\n- 在任何 HTTP 响应中返回完整 API key\n- 接受空 Referer 调凭证加载端点\n- 允许跨源网页调用本机 server\n- 自动或定时运行速率测试\n\n---\n\n## API 端点\n\n| 端点 | 说明 |\n|------|------|\n| `POST /api/load_cred` | 从 `~/.mmx/config.json` 加载 API key(用户点按钮 + confirm) |\n| `GET /api/token_plan` | 从 MiniMax 官方拉取配额(需已加载 key) |\n| `GET /api/probe` | 按需 API 延迟探测(用户点按钮 + confirm,需已加载 key) |\n| `GET /api/history?hours=24` | 24h 用量历史(本地滚动 buffer) |\n| `GET /health` | 健康检查 |\n\n---\n\n## 文件说明\n\n| 文件 | 说明 |\n|------|------|\n| `mmx-monitor.html` | 监控页面(单文件 HTML 前端) |\n| `mmx-monitor-server.js` | 本地代理服务(Node.js,端口 9877) |\n| `history.jsonl` | 24h 用量历史滚动 buffer(自动生成,不入 git) |\n| `SKILL.md` | 技能定义 |\n| `CHANGELOG.md` | 完整版本历史 |\n| `demo.png` | 仪表盘截图 |\n| `LICENSE` | MIT 许可证 |\n\n---\n\n## 常见问题\n\n**Q: 点击查询后提示\"连接失败\"?**\nA: 确认后端服务在跑(`node mmx-monitor-server.js`)。\n\n**Q: 端口 9877 被占用?**\nA: 停掉占用该端口的进程,或修改 `mmx-monitor-server.js` 中的 `PORT` 常量。\n\n---\n\n## 许可证\n\nMIT License — 见 [LICENSE](LICENSE)。\n\nFile v1.6.4:skill-card.md\n\n## Description: <br>\nMinimax Monitor starts a local dashboard for checking MiniMax Token Plan quota across 4-hour, 24-hour, and weekly windows and, when explicitly requested, running latency probes. <br>\n\nThis skill is ready for commercial/non-commercial use. <br>\n\n## Publisher: <br>\n[wangjipeng977](https://clawhub.ai/user/wangjipeng977) <br>\n\n### License/Terms of Use: <br>\nMIT-0 <br>\n\n\n## Use Case: <br>\nDevelopers and MiniMax API users use this skill to launch a localhost quota dashboard, load a MiniMax API key on demand, inspect package usage trends, and optionally run a small latency probe. <br>\n\n### Deployment Geography for Use: <br>\nGlobal <br>\n\n## Known Risks and Mitigations: <br>\nRisk: The local service can read and hold a MiniMax API key after user confirmation. <br>\nMitigation: Use it only on a trusted local machine, keep port 9877 private, and stop the service when monitoring is no longer needed. <br>\nRisk: Recurring quota polling and user-triggered latency probes can use MiniMax account quota. <br>\nMitigation: Load credentials only when actively monitoring, review the probe confirmation prompt, and avoid running probes unless the cost is acceptable. <br>\nRisk: The documented --no-probe safety switch is not enforced in this artifact. <br>\nMitigation: Do not rely on that flag as a control; avoid loading credentials or review and modify the probe endpoint before use if probe calls must be impossible. <br>\nRisk: The generated history.jsonl file records recent quota usage percentages. <br>\nMitigation: Treat the history file as local usage metadata and delete it after use if those trends are sensitive. <br>\n\n\n## Reference(s): <br>\n- [ClawHub skill page](https://clawhub.ai/wangjipeng977/skills/minimax-monitor) <br>\n- [Release metadata source](https://github.com/MiniMax-AI/skills) <br>\n- [README.md](README.md) <br>\n- [CHANGELOG.md](CHANGELOG.md) <br>\n\n\n## Skill Output: <br>\n**Output Type(s):** [Shell commands, Guidance, Configuration, Text, Files] <br>\n**Output Format:** [Markdown guidance with shell commands and JSON responses from a local dashboard] <br>\n**Output Parameters:** [1D] <br>\n**Other Properties Related to Output:** [May start a localhost service on port 9877 and write a local history.jsonl usage buffer.] <br>\n\n## Skill Version(s): <br>\n1.6.4 (source: ClawHub release metadata; artifact files report 1.6.3) <br>\n\n## Ethical Considerations: <br>\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment. <br>\n\nArchive v1.6.3: 9 files, 33912 bytes\n\nFiles: CHANGELOG.md (6045b), CONTRIBUTING.md (2173b), mmx-monitor-server.js (23085b), mmx-monitor.html (32620b), README_zh.md (5292b), README.md (5228b), skill-card.md (2206b), SKILL.md (9856b), _meta.json (134b)\n\nFile v1.6.3:SKILL.md\n\n---\nname: minimax-monitor\ndescription: >\n  Use when (1) user says \"mmx 仪表盘启动\" / \"mmx monitor\" / \"MiniMax 配额查询\" / \"打开 minimax 监控\" and wants a real-time dashboard.\n  (2) user wants to check how much of their MiniMax Token Plan quota is left (4h / 24h / weekly windows for M3 / M2.7 / video / music / image models).\n  (3) user wants to test MiniMax inference latency (TTFT / P50 / burst) by clicking \"开始速率测试\" - explicitly opt-in, NOT background.\nlicense: MIT\nmetadata:\n  version: \"1.6.3\"\n  category: dev-tools\n  author: wangjipeng\n  sources:\n    - https://github.com/MiniMax-AI/skills\nversion: 1.6.2\npermissions:\n  - read:filesystem       # ~/.mmx/config.json\n  - write:filesystem      # history.jsonl (24h ring buffer, 本技能目录)\n  - read:env               # MINIMAX_API_KEY\n  - network:outbound       # api.minimaxi.com / www.minimaxi.com\n  - shell:exec             # 'open' 命令启动浏览器\n---\n\n# MiniMax 套餐监控 + 速率测试中心\n\n> **触发词**:mmx 仪表盘启动\n>\n> **两个职责**:\n> 1. **实时配额查询** -- 60s 轮询官方 token_plan API,显示 4h / 24h / 本周用量、模型卡片、24h 趋势。\n> 2. **按需速率测试** -- 用户点 \"开始速率测试\" 按钮才发起 5 次 chat completion 请求(约 180 token 上限),返回 TTFT / P50 / burst / token-s。\n>\n> 启动后自动用 `open` 命令唤起浏览器打开 `http://127.0.0.1:9877/`。\n\n## v1.6.2 主要功能\n\n### 安全\n\n- 🔒 **本地凭证按需加载**。Server 启动**不读** `~/.mmx/config.json`。用户在仪表盘顶部点 \"加载本地凭证\" 按钮 + `confirm()` 二次确认后,才通过 `POST /api/load_cred` 读取 API key,存入 server 进程内存(不写磁盘、不写浏览器、不上传)。Server 重启后 key 丢失。\n- 🔒 **`/api/load_cred` 响应不含完整 API key**(只回 `keyLength` + `keyPrefix` 前 6 字符用于视觉确认)。\n- 🔒 **`/api/load_cred` 拒绝空 Referer**,强制 `Referer` 是本机白名单 `127.0.0.1 / localhost / file://` 之一。\n- 🔒 **CORS 严格**:`Access-Control-Allow-Origin` 仅放行 `127.0.0.1 / localhost / file://`。恶意网页无法跨域调本机 server 消耗你的 MiniMax 配额。\n- 🔒 **速率测试按需**:`/api/probe` 不再后台定时调用。仅在用户点 \"开始速率测试\" 按钮时才发起 5 次 chat completion,UI 红字提示 + 二次确认。\n\n### 配额监控\n\n- 📊 **4 小时 / 24 小时 / 本周** 三档用量追踪(4 小时为主圆环,按用户当前 Token Plan 套餐的实际周期动态显示)。\n- 🎯 **模型卡片** 区分 4h 限额 / 24h 限额 / 周无限额 / 套餐未启用(视频模型 status=3 元数据不可区分时显示 \"套餐未启用 · 不可调用\" 提示并排除出 4h 聚合)。\n- 📈 **24 小时趋势线**:`history.jsonl` 滚动 buffer(本技能目录)记录每次 `token_plan` 调用的用量快照,前端画趋势线。\n\n### 速率测试\n\n- ⚡ **TTFT / P50 / 突发并发 / token·s** 四项指标,基于真实 chat completion 请求。\n- ⚠️ **UI 红字 + confirm()** 提示每次测试消耗约 180 token,需用户主动确认。\n\n### 启动\n\n```bash\nnode ~/.openclaw/workspace/skills/minimax-monitor/mmx-monitor-server.js\n# 浏览器访问 http://127.0.0.1:9877/\n```\n\n高级选项:\n\n```bash\n# 启用 X-MMX-API-Key header 透传(默认拒绝)\nnode mmx-monitor-server.js --allow-header-key\n# 完全关闭速率测试端点\nnode mmx-monitor-server.js --no-probe\n```\n\n## Security & Data Flow\n\n本技能默认会:\n\n1. **读取本地凭证(按需)**:从 `~/.mmx/config.json` 读取 `api_key`(MiniMax Token Plan key)。**仅在用户主动点击 \"加载本地凭证\" 按钮时才会读**(`POST /api/load_cred`),server 启动时**不**读。读到的 key 存 server 进程内存,不写盘、不上传,server 重启后清空。\n2. **定时调用 MiniMax API**:每 60s 调 `https://www.minimaxi.com/v1/token_plan/remains` 拿配额数据。\n3. **写入本地采样数据**:每次 `fetchQuota` 后向 `<skill-dir>/history.jsonl` 追加一行 `(timestamp, usedPct, modelSnapshot)`,保留最近 24h 滚动 buffer,供前端画趋势线。不存凭证、不存个人信息。\n4. **速率测试需用户主动触发**:v1.6.0 起,仪表盘速率面板**不再自动**调用 chat completion。点 \"开始速率测试\" 按钮才会发起 5 次真实 chat 请求(约 180 token 上限),UI 会有红字提示 + 二次确认。\n\n**不会做**:\n\n- 不会把 API key 上传到任何远程(仅本地使用)。\n- 不会在 `load_cred` 响应里返回 key。\n- 不会允许跨源网页调用本机 server(CORS allowlist 限定 `127.0.0.1 / localhost / file://`)。\n- 不会接受空 Referer 调 `load_cred`(强制本机页面发起的请求才放行)。\n- 不会在后台悄悄消耗你的 chat 配额(v1.6.0 起 probe 改按需触发;不点不动)。\n\n**操作风险提示**:\n\n- **本地凭证访问**:点击 \"加载本地凭证\" 按钮会读取 `~/.mmx/config.json` 的 `api_key`,并把 key 存入本机 server 进程内存。建议:仅在本机使用本技能,不要把 9877 端口对外暴露。\n- **持续出站轮询**:每 60s 一次的 `token_plan/remains` 调用会持续消耗 MiniMax 配额查询额度(Token Plan 套餐内免费)。如果不需要实时面板,可手动 `Ctrl+C` 停 server。\n- **本地历史文件**:`history.jsonl` 包含时间序列的用量百分比,**不包含**凭证或个人身份信息;不慎泄漏也只是用量趋势。\n\n**想使用 header 透传 key**(高级用户,需要自负责):`node mmx-monitor-server.js --allow-header-key`\n\n---\n\n## Modes\n\n### `dashboard` (default)\nReal-time token-plan quota monitor. Server polls `https://www.minimaxi.com/v1/token_plan/remains` every 60s after credentials are loaded. Renders ring chart, per-model cards, and 24h trend line. **This is what runs by default when the user says \"mmx 仪表盘启动\".**\n\n### `probe` (opt-in)\nOn-demand inference latency test. Triggered **only** by the dashboard button \"开始速率测试\" - never by timer. Runs 5 chat completions against `api.minimaxi.com/v1/text/chatcompletion_v2` (model `MiniMax-M2.7`, max_tokens=30-60, mix of streaming/non-streaming). Returns TTFT, P50, burst, token/s metrics. **Costs ~180 tokens per click; UI shows red warning + confirm() dialog before firing.**\n\n### `history` (read-only)\nReads `history.jsonl` (24h ring buffer at `<skill-dir>/history.jsonl`) and returns time-series usage samples via `GET /api/history?hours=24`. No writes. Used by the dashboard's trend line widget.\n\n---\n\n## Do not\n\n- ❌ **Do not** auto-read `~/.mmx/config.json` on server startup. The credential is loaded **only** when the user explicitly clicks \"加载本地凭证\" (v1.6.0+).\n- ❌ **Do not** return the API key in any HTTP response body. `POST /api/load_cred` returns `keyLength` + `keyPrefix` only (v1.6.1+).\n- ❌ **Do not** accept empty `Referer` on `/api/load_cred`. Curl / CLI calls must include `-H 'Referer: http://127.0.0.1:9877/'` (v1.6.1+).\n- ❌ **Do not** run the inference probe in the background or on a timer. Probe is button-only, confirm-required, ~180 token cost per click (v1.6.0+).\n- ❌ **Do not** allow cross-origin web pages to reach the local server. CORS allowlist is `127.0.0.1 / localhost / file://` only (v1.4.0+).\n- ❌ **Do not** claim \"auto-read\" in any documentation. The only consistent narrative is \"on-demand, user-initiated, in-memory only\".\n\n---\n\n## Good vs. Bad Examples\n\n| Scenario | ❌ Bad (v1.5.x and earlier) | ✅ Good (v1.6.1+) |\n|----------|---------------------------|------------------|\n| Server startup | Reads `~/.mmx/config.json` silently; loads key into memory at boot | Reads nothing; `credLoadedKey = ''`; waits for user click \n\nArchive v1.6.2: 9 files, 33436 bytes\n\nFiles: CHANGELOG.md (5054b), CONTRIBUTING.md (2173b), mmx-monitor-server.js (22979b), mmx-monitor.html (31790b), README_zh.md (5292b), README.md (5228b), skill-card.md (2768b), SKILL.md (9856b), _meta.json (134b)\n\nArchive v1.6.1: 9 files, 45878 bytes\n\nFiles: CHANGELOG.md (15727b), CONTRIBUTING.md (2173b), mmx-monitor-server.js (22979b), mmx-monitor.html (31790b), README_zh.md (10774b), README.md (11003b), skill-card.md (2487b), SKILL.md (15019b), _meta.json (134b)","readmeExcerpt":"Skill: Minimax Monitor Owner: wangjipeng977 Summary: Use when (1) user says \"mmx 仪表盘启动\" / \"mmx monitor\" / \"MiniMax 配额查询\" / \"打开 minimax 监控\" and wants a real-time dashboard. (2) user wants to check how much of th... Tags: latest:1.7.0 Version history: v1.7.0 | 2026-07-03T08:55:59.374Z | user test v1.6.7 | 2026-06-30T06:09:23.331Z | user fix: 加载本地凭证按钮 success 判断 d.key → d.loaded (v1.6.1 之后 server 响应不回完整 key,前端必须改用 loade","codeSnippets":[],"executableExamples":[{"language":"bash","snippet":"node ~/.openclaw/workspace/skills/minimax-monitor/mmx-monitor-server.js\n# 浏览器访问 http://127.0.0.1:9877/"},{"language":"bash","snippet":"# 启用 X-MMX-API-Key header 透传(默认拒绝)\nnode mmx-monitor-server.js --allow-header-key\n# 完全关闭速率测试端点\nnode mmx-monitor-server.js --no-probe"},{"language":"bash","snippet":"# 1. Start backend service\nnode mmx-monitor-server.js\n\n# 2. Open browser (macOS auto-opens http://127.0.0.1:9877/)\nopen http://127.0.0.1:9877/\n# Windows / Linux: navigate to http://127.0.0.1:9877/ manually"},{"language":"bash","snippet":"# Default\nnode mmx-monitor-server.js\n\n# Enable X-MMX-API-Key header passthrough (advanced)\nnode mmx-monitor-server.js --allow-header-key\n\n# Disable /api/probe endpoint entirely (no inference calls)\nnode mmx-monitor-server.js --no-probe"},{"language":"bash","snippet":"# Copy template\ncp .env.example .env\n\nMINIMAX_API_KEY=sk-cp-…here           # MiniMax API Key (Token Plan type)"},{"language":"bash","snippet":"# 1. Fork the repository on GitHub\n\n# 2. Clone your fork\ngit clone https://github.com/wangjipeng977/minimax-monitor.git\ncd minimax-monitor\n\n# 3. Install dependencies (none — pure Node.js stdlib, no npm install needed)\n\n# 4. Run the self-audit to verify quality\npython ~/.openclaw/workspace/skills/skill-factory/scripts/audit_skill.py . --hit-score"}],"parameters":null,"dependencies":[],"permissions":[],"extractedFiles":[{"path":"SKILL.md","content":"---\nname: minimax-monitor\ndescription: >\n  Use when (1) user says \"mmx 仪表盘启动\" / \"mmx monitor\" / \"MiniMax 配额查询\" / \"打开 minimax 监控\" and wants a real-time dashboard.\n  (2) user wants to check how much of their MiniMax Token Plan quota is left (4h / 24h / weekly windows for M3 / M2.7 / video / music / image models).\n  (3) user wants to test MiniMax inference latency (TTFT / P50 / burst) by clicking \"开始速率测试\" - explicitly opt-in, NOT background.\nlicense: MIT\nmetadata:\n  version: \"1.7.0\"\n  category: dev-tools\n  author: wangjipeng\n  sources:\n    - https://github.com/MiniMax-AI/skills\npermissions:\n  - read:filesystem       # ~/.mmx/config.json (v1.7.0: 按需读,不缓存)\n  - write:filesystem      # history.jsonl (24h ring buffer, 本技能目录)\n  - read:env               # MINIMAX_API_KEY\n  - network:outbound       # api.minimaxi.com / www.minimaxi.com\n  - shell:exec             # 'open' 命令启动浏览器\n---\n\n# MiniMax 套餐监控 + 速率测试中心\n\n> **触发词**:mmx 仪表盘启动\n>\n> **两个职责**:\n> 1. **实时配额查询** -- 60s 轮询官方 token_plan API,显示 4h / 24h / 本周用量、模型卡片、24h 趋势。\n> 2. **按需速率测试** -- 用户点 \"开始速率测试\" 按钮才发起 5 次 chat completion 请求(约 180 token 上限),返回 TTFT / P50 / burst / token-s。\n>\n> 启动后自动用 `open` 命令唤起浏览器打开 `http://127.0.0.1:9877/`。\n\n## v1.7.0 主要功能 (v1.6.7 → v1.7.0 增量)\n\n### v1.7.0 安全加固\n\n- 🔒 **凭证不在 server 进程内存中常驻**(v1.6.x → v1.7.0 重大变更)。每次需要 API key 的请求由 `loadKeyForRequest()` 现读 `~/.mmx/config.json`,用完即出栈,Node.js GC 一轮后释放。**进程内存 dump 拿不到完整 key**(lldb 验证: `memory find --string \"sk-cp-\"` 在 rw 段无命中)。\n- 🔒 **`/api/load_cred` 不再写入模块作用域**。仅向前端返回\"凭证已就绪\"标记 + `keyLength`/`keyPrefix`(前 6 字符)。前端 `credLoaded=true` 现在是 UX 标记,不再控制权限。\n\n### 安全 (v1.6.x 累计)\n\n- 🔒 **本地凭证按需加载**。Server 启动**不读** `~/.mmx/config.json`。用户在仪表盘顶部点 \"加载本地凭证\" 按钮 + `confirm()` 二次确认后,才通过 `POST /api/load_cred` 读取 API key。Server 重启后 key 丢失(v1.7.0 起 key 也从不进 server 内存,仅磁盘上原生存在的 `~/.mmx/config.json`)。\n- 🔒 **`/api/load_cred` 响应不含完整 API key**(只回 `keyLength` + `keyPrefix` 前 6 字符用于视觉确认)。\n- 🔒 **`/api/load_cred` 拒绝空 Referer**,强制 `Referer` 是本机白名单 `127.0.0.1 / localhost / file://` 之一。\n- 🔒 **CORS 严格**:`Access-Control-Allow-Origin` 仅放行 `127.0.0.1 / localhost / file://`。恶意网页无法跨域调本机 server 消耗你的 MiniMax 配额。\n- 🔒 **速率测试按需**:`/api/probe` 不再后台定时调用。仅在用户点 \"开始速率测试\" 按钮时才发起 5 次 chat completion,UI 红字提示 + 二次确认。\n\n### 配额监控\n\n- 📊 **4 小时 / 24 小时 / 本周** 三档用量追踪(4 小时为主圆环,按用户当前 Token Plan 套餐的实际周期动态显示)。\n- 🎯 **模型卡片** 区分 4h 限额 / 24h 限额 / 周无限额 / 套餐未启用(视频模型 status=3 元数据不可区分时显示 \"套餐未启用 · 不可调用\" 提示并排除出 4h 聚合)。\n- 📈 **24 小时趋势线**:`history.jsonl` 滚动 buffer(本技能目录)记录每次 `token_plan` 调用的用量快照,前端画趋势线。\n\n### 速率测试\n\n- ⚡ **TTFT / P50 / 突发并发 / token·s** 四项指标,基于真实 chat completion 请求。\n- ⚠️ **UI 红字 + confirm()** 提示每次测试消耗约 180 token,需用户主动确认。\n\n### 启动\n\n```bash\nnode ~/.openclaw/workspace/skills/minimax-monitor/mmx-monitor-server.js\n# 浏览器访问 http://127.0.0.1:9877/\n```\n\n高级选项:\n\n```bash\n# 启用 X-MMX-API-Key header 透传(默认拒绝)\nnode mmx-monitor-server.js --allow-header-key\n# 完全关闭速率测试端点\nnode mmx-monitor-server.js --no-probe\n```\n\n## Security & Data Flow\n\n本技能默认会:\n\n1. **按需读取本地凭证(v1.7.0: 不进内存)**:从 `~/.mmx/config.json` 读取 `api_key`(MiniMax "},{"path":"README.md","content":"# MiniMax Package Monitor\n\n[中文版](./README_zh.md)\n\nReal-time local dashboard for monitoring MiniMax API package usage — quota tracking, on-demand rate probing, weekly usage, and 24h history.\n\n> **Current Version: v1.7.0** | [CHANGELOG](CHANGELOG.md) | [License](LICENSE)\n\n![Dashboard](demo.png)\n\n![License](https://img.shields.io/badge/License-MIT-blue)\n\n---\n\n## Features (v1.7.0)\n\n### Quota Monitoring\n\n- 📊 **4-hour / 24-hour / weekly** usage windows — primary ring chart shows the user's actual Token Plan cycle\n- 🎯 **Per-model cards** distinguish 4h-capped / 24h-capped / no-weekly-limit / plan-not-enabled (video) cases\n- 📈 **24-hour trend line** from local `history.jsonl` ring buffer\n\n### Rate Probing (on-demand)\n\n- ⚡ **TTFT / P50 / burst / token·s** measurements from real chat completion requests\n- ⚠️ **Button-only with confirm() dialog** — costs ~180 tokens per click, never fires automatically\n\n### Security\n\n- 🔒 **Credential loaded on demand, never cached** — Server does **not** auto-read `~/.mmx/config.json` and does **not** cache the key in process memory (v1.7.0+). Dashboard's \"加载本地凭证\" button + `confirm()` triggers `POST /api/load_cred` which authorizes the server to re-read the key from disk on every request. `lldb memory find` on the server process shows no key in writable memory regions.\n- 🔒 **`/api/load_cred` response excludes the full key** — returns `keyLength` + `keyPrefix` (first 6 chars) only\n- 🔒 **`/api/load_cred` rejects empty `Referer`** — must come from a local-origin page (`127.0.0.1 / localhost / file://`)\n- 🔒 **CORS allowlist** — only `127.0.0.1 / localhost / file://` can reach the local server\n- 🔒 **No remote key transmission** — API key never leaves the local machine\n\n---\n\n## Quick Start\n\n### Prerequisites\n\n- Node.js ≥ 18\n\n### Run\n\n```bash\n# 1. Start backend service\nnode mmx-monitor-server.js\n\n# 2. Open browser (macOS auto-opens http://127.0.0.1:9877/)\nopen http://127.0.0.1:9877/\n# Windows / Linux: navigate to http://127.0.0.1:9877/ manually\n```\n\n### Load API Key\n\nAfter the page loads, click **\"加载本地凭证\"** button → confirm → server is authorized to read `~/.mmx/config.json` on demand. The key is read fresh on every `/api/token_plan` / `/api/probe` call, used, then discarded by GC (never cached in process memory). Or paste your key directly into the input box for `--allow-header-key` mode.\n\n---\n\n## Startup Options\n\n```bash\n# Default\nnode mmx-monitor-server.js\n\n# Enable X-MMX-API-Key header passthrough (advanced)\nnode mmx-monitor-server.js --allow-header-key\n\n# Disable /api/probe endpoint entirely (no inference calls)\nnode mmx-monitor-server.js --no-probe\n```\n\n---\n\n## Configuration\n\n### mmx Local Config (on-demand, never cached)\n\nThe backend **does not auto-read** `~/.mmx/config.json` and **does not cache** the key in process memory. Use the dashboard's **\"加载本地凭证\"** button to authorize on-demand reads of `~/.mmx/config.json` (read on every request, used, discarded). The key is never held in process memory and is never writt"},{"path":"_meta.json","content":"{\n  \"ownerId\": \"kn70zthc74p61mvctddrancx0s832g4r\",\n  \"slug\": \"minimax-monitor\",\n  \"version\": \"1.7.0\",\n  \"publishedAt\": 1783068959374\n}"},{"path":"CHANGELOG.md","content":"# Changelog\n\nAll notable changes to MiniMax Monitor will be documented in this file.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n\n## [1.6.7] - 2026-06-30\n\n### Bug Fix\n- 🐛 \"加载本地凭证\" 按钮 success 判断: `d.key` → `d.loaded` (v1.6.1 加固后 server 响应不再回完整 key, 前端必须改用 `loaded` 字段判断成功)\n- 🐛 前端不再持有 key: 新增 `credLoaded` boolean 标记, `fetchQuota` / `doSpeedTest` 不再传 `X-MMX-API-Key` header, server 走 `credLoadedKey` (进程变量) 读 key (与 v1.6.1 \"响应不回完整 key\" 加固保持一致)\n- 🐛 按钮文本简化: `✅ 已加载 (sk-cp-…)` → `✅ 已加载` (按用户偏好, 不在 UI 显示 key 前缀)\n\n### Documentation\n- 🧹 bump 本地展示位 1.6.6 → 1.6.7 (Current Version / 当前版本 / ## Features / ## 功能 / ## 主要功能 / metadata.version)\n\n## [1.6.6] - 2026-06-30\n\n### Documentation\n- 🐛 删除 SKILL.md frontmatter 顶层残留 `version: 1.6.2` 字段（ClawHub 优先解析顶层 key,导致 v1.6.3+ 发布后页面仍显示 v1.6.2）\n- 🐛 同步 README.md / README_zh.md 顶部 `Current Version` / `当前版本` 行以及 `## Features` / `## 功能` 段标题随发布版本一起更新\n\n## [1.6.5] - 2026-06-30\n\n### Documentation\n- 🐛 SKILL.md `metadata.version` 1.6.3 → 1.6.5（docs-only bump publish 链同步）\n\n## [1.6.3] - 2026-06-30\n\n### Security\n- 🐛 `/api/probe` 拒绝空 `Referer`（之前空 `Referer` 会被静默放行,绕过了本机 origin 二次确认 → curl/本机直连可直接触发真实 API 调用)\n- 🐛 加载本地凭证后,API key 不再写回 `input.value`（之前 key 进入 DOM,password 字段只是 UI 遮罩,肩窥/扩展/DevTools 仍可读）——现在只存内存变量,input 显示占位符,加 `data-loaded=\"1\"` 标记让「查询」按钮识别「已加载」状态不要覆盖\n\n## [1.6.2] - 2026-06-29\n\n### Security\n- 🐛 `/api/probe` 拒绝空 `Referer`（之前空 `Referer` 会被静默放行,绕过了本机 origin 二次确认 → curl/本机直连可直接触发真实 API 调用)\n- 🐛 加载本地凭证后,API key 不再写回 `input.value`（之前 key 进入 DOM,password 字段只是 UI 遮罩,肩窥/扩展/DevTools 仍可读）——现在只存内存变量,input 显示占位符,加 `data-loaded=\"1\"` 标记让「查询」按钮识别「已加载」状态不要覆盖\n\n### Documentation\n- 🧹 SKILL.md 删「## 更新日志」整段（v1.6.0/v1.5.0/v1.4.0/...）— ClawHub 全文渲染不再堆历史\n- 🧹 SKILL.md 删 Security 重复段 + 删冗余「技能简介 / 触发词收敛 / 文件说明 / 使用方式 / 环境变量 / 注意事项」段\n- 🧹 README.md / README_zh.md 重写 — 顶部「Current Version: v1.6.1」+「Features (v1.6.1)」只描述当前版本功能，不堆 Changelog 历史\n- 🧹 CHANGELOG.md 重写 — 保留累积变更（行业惯例），精简每版条目、去掉审计器 finding 编号等内部叙事噪音\n\n## [1.6.1] - 2026-06-29\n\n### Security\n- 🐛 `/api/load_cred` 响应不再返回完整 API key（只回 `keyLength` + `keyPrefix` 前 6 字符）\n- 🐛 `/api/load_cred` 拒绝空 `Referer`，强制本机白名单\n- 📝 SKILL.md frontmatter `permissions` 补 `write:filesystem`（声明 `history.jsonl` 写入）\n\n### Documentation\n- 🧹 清理 README 自相矛盾 — 所有\"自动读取 `~/.mmx/config.json`\"的旧表述统一改为\"按需主动加载\"叙事\n- 📝 SKILL.md Security 段重写 + 加 `history.jsonl` 持久化披露 + 操作风险提示\n- 📝 新增 CONTRIBUTING.md\n\n## [1.6.0] - 2026-06-26\n\n### Security Hardening\n- 🔒 凭证按需加载 — Server 启动不读 `~/.mmx/config.json`，仪表盘点 \"加载本地凭证\" 按钮 + confirm 才读\n- 🔒 删除浏览器 localStorage 24h 记忆 — 重启后必须重新输入或重新加载\n- 🔒 速率测试改按需 — 仪表盘速率面板不再自动调用 chat completion，需用户点 \"开始速率测试\" 按钮 + confirm\n- 🔒 删除飞书推送 — 飞书 OAuth 协议要求发 `FEISHU_APP_SECRET`，无法通过文档警示消除该风险\n\n### Other\n- 🛠 Server 直接服务 HTML（`http://127.0.0.1:9877/`），绕开 Safari `file://` fetch 报错\n- 📝 SKILL.md description 改为诚实版（\"套餐监控 + 速率测试\"双职责）\n\n## [1.5.1] - 2026-06-26\n\n### Changed\n- 🔒 触发词收敛为单一 `mmx 仪表盘启动`（从 4 个泛"},{"path":"CONTRIBUTING.md","content":"# Contributing to `minimax-monitor`\n\nThank you for your interest in contributing! Please follow these steps to set up your development environment and submit changes.\n\n## Development Setup\n\n```bash\n# 1. Fork the repository on GitHub\n\n# 2. Clone your fork\ngit clone https://github.com/wangjipeng977/minimax-monitor.git\ncd minimax-monitor\n\n# 3. Install dependencies (none — pure Node.js stdlib, no npm install needed)\n\n# 4. Run the self-audit to verify quality\npython ~/.openclaw/workspace/skills/skill-factory/scripts/audit_skill.py . --hit-score\n```\n\n## Workflow\n\nWe use a standard feature branch workflow:\n\n```bash\n# 1. Create a new branch from main\ngit checkout -b feat/<your-feature-name>\n\n# 2. Make your changes\n#    - Follow the SKILL.md structure standards\n#    - Keep SKILL.md body in English\n#    - Do not hardcode API keys or secrets\n\n# 3. Run the audit to check for issues\npython scripts/audit_skill.py .\n\n# 4. Commit your changes\ngit add .\ngit commit -m \"feat(minimax-monitor): add <brief description>\"\n\n# 5. Push to your fork\ngit push origin feat/<your-feature-name>\n\n# 6. Open a Pull Request on GitHub\n#    - Title: feat(minimax-monitor): add <brief description>\n#    - Description: What + Why + Testing\n```\n\n## Code Standards\n\n- **SKILL.md**: Follow the YAML frontmatter standard (name, description, license, metadata)\n- **Scripts**: Must include shebang, requirements.txt, and graceful error handling\n- **Language**: SKILL.md body must be in English; reference docs in English\n- **No secrets**: Never commit API keys, tokens, or credentials\n\n## Quality Checklist\n\nBefore opening a PR, verify:\n\n- [ ] `audit_skill.py` exits with code 0 or 2\n- [ ] `validate_skills.py` exits with code 0\n- [ ] README.md and README_zh.md are both present\n- [ ] CONTRIBUTING.md is present\n- [ ] .gitignore is present\n- [ ] No hardcoded secrets anywhere in the codebase\n\n## Reporting Issues\n\nPlease report issues via GitHub Issues with:\n\n1. **What you expected to happen**\n2. **What actually happened**\n3. **Steps to reproduce**\n4. **Environment** (OS, Python version, etc.)\n\n## License\n\nBy contributing, you agree that your contributions will be licensed under the MIT License."}],"languages":[],"docsSourceLabel":"CLAWHUB","editorialOverview":null,"editorialQuality":{"score":100,"threshold":65,"status":"thin","wordCount":1496,"uniquenessScore":42,"reasons":["uniqueness-below-45"]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-10-11T23:41:01.329Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-10-11T23:41:01.329Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-14T11:23:48.425Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}