fix(auxiliary): add minimax-oauth support to resolve_provider_client

[ilonagaja509-glitch]

Fixes #22213

Adds minimax-oauth provider support to the auxiliary provider resolver.

[alt-glitch]

Duplicate of #23639 (and closed #30059, #25287, #27640) — all fix #22213 by adding oauth_minimax to resolve_provider_client(). #23639 is the oldest open PR with the same fix.

[keegoid-codex]

Bugs

• [CAT-1] Import failure catches only ImportError; build_anthropic_client() runtime errors escape agent/auxiliary_client.py:3683.

Severity

• medium. Missing credential/client error path can break auxiliary resolver at runtime.

VERDICT: request_changes

---

codex-review posting override: forced to --comment because reviewer lacks verified write permission (viewerPermission=READ; was --request-changes). GitHub only counts approvals from WRITE, MAINTAIN, or ADMIN reviewers.

[keegoid-cc]

[DEV SecOps] verdict: PASS
verified at 504e397

• Scope: inspected fix(auxiliary): add minimax-oauth support to resolve_provider_client #30497 at pinned head; one file changed: agent/auxiliary_client.py (+31/-1), adding minimax-oauth handling in resolve_provider_client.
• Prompt-injection: no findings in PR title/body, commit headline, changed comments, or added string literals; hidden-Unicode scan clean.
• Dependencies / lockfile: no manifest or lockfile files changed; no new package registry surface.
• CI / workflow injection: no workflow/CI files changed; no pull_request_target, secrets, self-hosted runner, or run interpolation changes.
• Generated/copied code provenance: no large generated/copied block over review threshold; added code is small integration glue reusing existing MiniMax OAuth credential resolver and Anthropic adapter.
• Secret exposure / unsafe permissions: no hardcoded secrets or token literals; new code reads runtime OAuth access token through existing credential resolver and does not log token material.
• Ops/security regression check: network egress remains provider-scoped to existing MiniMax OAuth inference_base_url state; no shell, subprocess, eval, file permission, deployment, or credential-broadening changes found.
• Residual risk: static/read-only inspection only; did not execute PR code or run tests.

[keegoid-codex]

Bugs

• [CAT-1] Preserve prior blocker: build_anthropic_client() exceptions bypass fallback agent/auxiliary_client.py:3683.

Severity

• medium. Unhandled MiniMax OAuth client failures break auxiliary resolution.

VERDICT: request_changes

---

codex-review posting override: forced to --comment because reviewer lacks verified write permission (viewerPermission=READ; was --request-changes). GitHub only counts approvals from WRITE, MAINTAIN, or ADMIN reviewers.

[keegoid-cc]

[DEV SecOps] verdict: PASS
verified at 504e397

• Scope pinned: fix(auxiliary): add minimax-oauth support to resolve_provider_client #30497, base main, head fix/minimax-oauth-auxiliary-client, 1 commit, 1 file (agent/auxiliary_client.py, +31/-1).
• Prompt-injection: no findings. Scanned changed comments/string literals and commit message for instruction-bearing trigger text plus hidden Unicode/bidi controls; none found.
• Dependency/lockfile: no findings. No manifest or lockfile changes; no new package registry risk introduced.
• CI/workflow injection: no findings. No workflow/CI files changed; no new pull_request_target, secrets reads, self-hosted runner labels, or direct event/input interpolation in shell.
• Generated/copied provenance: no findings. Added block is a narrow local resolver branch using existing MiniMax OAuth credential resolver and existing Anthropic auxiliary wrapper; no large copied/generated artifact indicators.
• Secret exposure: no findings. Code reads runtime OAuth credentials through existing resolve_minimax_oauth_runtime_credentials() and passes the token to the existing client wrapper; no hardcoded secrets and no credential logging in the diff.
• Ops/security regression: no findings. New network target is the configured MiniMax OAuth inference base URL returned by existing auth plumbing; no shell execution, file writes, subprocess, eval/exec, base64 blob, or unexpected outbound path in the diff.
• Read-only checks used: gh-as cc pr view, gh-as cc pr diff, git fetch to read pinned PR ref, git diff --check, static pattern scan against diff/commit metadata. No untrusted PR code executed.

[ilonagaja509-glitch]

Closing as duplicate of #23639 which addresses the same issue.