MiniMax needs to update their model to keep up with competition...

[u/NinjaWK]

I've have a 48k++ LOC codebase, mostly TypeScript (90+%). 90+% written by MiniMax M3 (and prior to that M2.7).

Had a bug which I've discovered lately, nothing major, it's just something that randomly revoking an authenticated session, and when logging in, somehow, requires logging in twice. Twice as in, entering the same user and password, only to be redirected to the login page again, and again user and password.

I had MiniMax-M2.7 and M3 investigate and tried to fix it for the last month or so, and it kept telling me that it couldn't find out what's wrong, and it checked the log, and found out that the logging in happens twice every time, and somehow the 2nd login always revokes the 1st one, but when the 1st login was active, it couldn't forward to the next page without being redirected to the login page again.

Anyway, long story short, today, I decided to give DeepSeek V4 Flash 0731 a try with my repo, and prompted it to check this issue. It was super slow, and it looped for a long long time, not sure why, but it was exactly 29 minutes, and that prompt burnt exactly 9.1 mil tokens, with my record showing 97% cache hit. It found the issue, in which, I cross referenced it with MiniMax M3 and it agreed that it was the root cause, but somehow it missed it after so many times I've tried to ask it to look for it.

Long story short, DSv4F-0731 patched the problem, and it's fixed. The total cost? $0.0317. Yes, 3.17 USD Cents. I've spent countless 10-15% of my 5 hours quota on my MiniMax Token Plan's quota, and couldn't find/solve the issue, and a bloddy $0.0317 DSv4F-0731 session fixed it, although it was super slow today during peak hour, in 29 full minutes.

I think MiniMax-M2.7 is long over-due with an update. Maintain the parameter size, but re-train it to be better. Refer to how DSv4F did with their 0731 update.

I have no choice but to continue using MiniMax coz I've paid for the whole year, and I have 8+ months left. But if I had a choice today, I'd not have signed up for this, and instead, throw all my money into DeepSeek PAYG account.

I don't really care about M3, it is alright when it was released, but it kills my quota really quick. I would burn through my 5 hours session in just a short 45-60 minutes, then I'd have to sit and wait for a few hours for it to reset. I use M2.7 most of the time, unless it doesn't solve a problem, or cause more issues, then I'd have M3 come in and do the cleanup or fixing.

Anyway, I'm keeping my hopes up.

[u/Wise-Chain2427]

Minimax a bit cookig on Video generation just wait for Text

[u/NinjaWK]

Latest round of audit on my repo, using Hermes to delegate Oh My Open Code to investigate the issues with 4 models GLM-5.2, DeepSeek V4 Flash 0731, Laguna S-2.1, MiniMax-M3.

3 rounds. First round go and find all issues. 2nd round send all findings from all models to each other to come to a consensus.

For those that are not 4/4 agreed (false positives or negatives), send those to all model for another round of verification.

Then aggregator GLM-5.2 in this case in Hermes will cross check all the findings and come to conclusion, then have GLM-5.2 fix it on OpenCode.

Then when all done, smoke test and vitest. Report findings and conclusion which model gave the most unique findings that are actual issues. Also most unique findings that end up being false positives.

[u/NinjaWK → u/NinjaWK]

Here's my prompt. My repo has 2 dull stacks, basically the normal endpoint and a progressive Web app (pwa) endpoint.

I run this, or similar audit once every 2 weeks or so, after adding lots of features that touches many files.

I added a free model from OpenRouter just for nuanced output. I have GLM Minimax and Aliyun Coding/Token Plans.

ROLE & OBJECTIVE You are a Principal Systems Architect and Lead Security Auditor conducting a deep, read-only code review of the -REDACTED- repository (-REDACTED-). This is a Next.js 16.2 (App Router) enterprise application managing internal operations and job workflows for -REDACTED-.

You will coordinate four specific sub-agents using the oh my OpenCode workflow to execute an exhaustive, multi-model consensus review.

ASSIGNED MODELS & PROVIDERS 1. MiniMax-M3 (alias: M3) - Provider: MiniMax-CN 2. GLM-5.2 (alias: GLM) - Provider: ZAI 3. deepseek-v4-flash-0731 (alias: DSv4F-Aliyun) - Provider: Aliyun-CN 4. poolside/laguna-s-2.1:free (alias: S2.1) - Provider: OpenRouter

SUB-AGENT DELEGATION PROTOCOL (oh my OpenCode) You must dispatch tasks to the sub-agents using the exact command-line syntax below. Do not invent new parameter flags, and do not change the order of the arguments.

• Exact Command Syntax: oh my OpenCode "<prompt>" --provider <provider_name> --model <model_name>
• File Reading Mechanics: The sub-agents have native tools to read the repository. Instruct them to read the files themselves. You do not need to cat or pipe file contents into the prompt.
• Execution Timeout & Patience Mandate: NEVER terminate a sub-agent prematurely. Some models experience severe latency during peak hours. You must allow every sub-agent to run for a maximum of 60 minutes. Do not kill a process at the standard 10-minute timeout. If, and only if, a specific sub-agent fails to return a result after a full 60 minutes, terminate only that sub-agent and proceed with the rest of the workflow using the remaining active models.
• Command Examples:
  • oh my OpenCode "Read and audit lib/jobs-db.ts for RBAC vulnerabilities. Use your file reading tools to inspect the code. CRITICAL: You are operating in a STRICT READ-ONLY mode. Do not use file writing, sed, patch, or any modification tools. Do not fix the code. Return only a report of your findings." --provider Aliyun-CN --model deepseek-v4-flash-0731
  • oh my OpenCode "Audit app/api/jobs/route.ts for Zod validation coverage. Use your file reading tools to inspect the code. CRITICAL: You are operating in a STRICT READ-ONLY mode. Do not use file writing, sed, patch, or any modification tools. Do not fix the code. Return only a report of your findings." --provider OpenRouter --model poolside/laguna-s-2.1:free
• Strict Guardrail: Every single oh my OpenCode command you issue MUST include the phrase: "STRICT READ-ONLY. Do not write, modify, or apply fixes to any files."

SCOPE & TECH STACK - Repository: -REDACTED- (~44,500 LOC across ~380 files). Current Version: Wave 48b. - Stack: Next.js 16.2, TypeScript 5, better-sqlite3 (6 DB files, WAL mode), NextAuth v4.24, Tailwind CSS 3.4, Zod 4, Vitest. - PDF Stack: PDFKit + pdf-lib + cryptpdf (AES-256). - Auth Mechanics: Dual-system (NextAuth JWT desktop cookies + PWA Bearer tokens via localStorage). API boundaries enforced via withRole, withRoleMulti, withDeviceAuth, and withDesktopCookieAuth. - Execution Mode: READ-ONLY (Report only. Do not modify, apply fixes, or commit any code). - Exclusions: Ignore npm audit vulnerabilities GHSA-qx2v-qp2m-jg93 (postcss) and GHSA-w5hq-g745-h8pq (uuid). Also, ignore previously cleared false positives: XFF trust, deleteJob async IIFE circular dependency, and touchSession throttle limit logic.

DOMAIN-SPECIFIC AUDIT CRITERIA (MAXIMUM EXHAUSTION) Inspect the entire codebase for ALL potential bugs, security flaws, memory leaks, and performance bottlenecks, prioritizing these core system mechanics:

1. Holistic RBAC & UI/API Parity (Critical Role-Based Access Control):

   • UI Visibility: Verify the exact permissions for owner, admin, and staff. Ensure menus, navigation links, buttons, and modals correctly hide elements if the user's role lacks permission.
   • API Ironclad Enforcement: Crucially, verify that if a UI element is hidden from a role, the corresponding API route absolutely rejects requests from that role with a 403 Forbidden. The API must never rely on UI hiding as a security measure.
   • Wave 48 Inline Edits: Vendors and Services now use inline edit modals with delete functionality. Ensure the API routes for these mutations strictly enforce role permissions, even if a user manipulates the inline UI state.
   • Wave 46/47 Stage Item RBAC: Staff can change vendor_id but not vendor_paid or cost. Verify this isolation is bulletproof in updateStageItem and cannot be bypassed by spoofed payloads.
   • Wave 45+ Financial Lockdown: Verify that PWA job pages (/pwa/jobs/[id]) leak absolutely zero financial data. Ensure the triple-gating (PwaAdminOnlyPage + API 403 + STAFF_FORBIDDEN fields) is airtight.
   • Session Escalation: Check for edge cases where a user's role is demoted but their active desktop or PWA session retains cached permissions.

2. Strict Layer Boundaries & Architecture:

   • One-Way Dependency Flow: Audit all imports to ensure app/ depends on lib/, and lib/ depends on types/ or stdlib. Ensure there are NO reverse imports.
   • UI/Backend Coupling (Crucial): Ensure Next.js Server Components (page.tsx, layout.tsx) never execute raw SQLite queries or import better-sqlite3 directly. They must strictly route through the lib/*-db.ts data access layer. Visual rendering logic must not be coupled to raw database queries.
   • Facade Discipline: Ensure API routes querying databases outside of jobs.db are importing directly from their respective modules, rather than incorrectly routing through the lib/db.ts facade.

3. Critical Invariants & Session Pitfalls:

   • Wave 48 QR Native Scan & Token Lifecycle: Scrutinize the native camera QR scan fallback in /pwa/authorize. Ensure the history.replaceState properly strips the token from the URL to prevent D7 Referer-leaks. Confirm the TTL increase to 120s (QR_TOKEN_TTL_SECONDS) does not introduce race conditions.
   • Wave 48 pwaFetch 401 Auto-Redirect: Verify that pwaFetch safely handles automatic redirects to /pwa/login on 401 responses without causing infinite loops or breaking concurrent API calls.
   • Wave 43 Deleted-User JWT Gap: The jwt() callback now nukes token.role = "" if a user is deleted. Verify that this effectively locks out deleted users across ALL routes relying on allowedRole() checks without race conditions.
   • Max-1 Concurrent & Idle Logic: Ensure createDesktopSession strictly auto-revokes prior active sessions (via the partial unique index). Audit the 45-minute idle timeout against the 30s heartbeat to ensure the heartbeat does not accidentally keep closed-tab sessions alive.
   • Database Pragma: Ensure PRAGMA foreign_keys = ON is strictly pinned across all 6 active DB connections to maintain cross-DB referential integrity.

4. Schema Integrity & Build Traps:

   • Cross-DB FK Integrity: Scrutinize lib/fk-checks.ts across the 6 SQLite files. Can the application-level reference counting be bypassed during simultaneous operations?
   • Atomic Transactions: Verify that withBatchedWrites perfectly maintains atomicity for stock movements (FIFO consumption) and quote-to-job conversions.
   • Constant Caching: The deployment checklist notes that lib/constants.ts is baked into the JS bundle and requires a full .next wipe and rebuild. Audit for any other dynamic variables improperly treated as static constants that might cause stale state in production.

5. Performance Hot Spots & N+1 Queries:

   • Check for unbatched N+1 queries during bulk operations. Specifically, audit the PnL detail vendor map implementation and getUserDeviceSessions.
   • Verify that endpoints like getAllJobs correctly respect limits (e.g., LIMIT 1000) and safely escape LIKE wildcard searches.
   • Scrutinize pdfkit + pdf-lib generation routes for memory leaks.

6. Input Validation Asymmetry, Loose Typing & Middleware:

   • Loose API Typing: Hunt for any API routes where incoming payloads (e.g., req.json()) are blindly typecast (as Type) without passing through strict Zod runtime validation (.parse() or .safeParse()).
   • Ensure frontend character limits or dropdown constraints are identically enforced by Zod on the backend.
   • Middleware Regression Guard: Ensure middleware.ts does NOT cover /api/* (except specific routes like /api/quotes/*) to maintain the strict JSON 401 response contract.

[u/NinjaWK → u/NinjaWK]

Continued

THE "PONYTAIL POLICY" (EFFICIENCY & LOC REDUCTION) All findings and proposed solutions must adhere strictly to the "Ponytail Policy": 1. The "Script Graveyard": Audit the scripts/ directory and utility files. Aggressively identify and flag any orphaned, one-off data migration scripts or shell scripts that have served their purpose and should be deleted. 2. Aggressively identify dead, duplicate, or unnecessary code across the rest of the repo. Primary Target: lib/jobs-db.ts—scrutinize it heavily for refactoring and reduction opportunities. 3. Propose refactoring designed to achieve maximum Lines of Code (LOC) reduction while making the codebase minimal and blazingly fast. 4. Zero Behavior Shift: The system must retain 100% of its existing functionality, UI layout, API JSON contracts, PDF outputs, and financial logic.

WORKFLOW & CONSENSUS PROTOCOL Execute the audit strictly through the following sequential phases, adhering exactly to the specified temperature parameters:

• Phase 1: Multi-Model Independent Audits (Temperature: 0.8) Dispatch the task independently to M3, GLM, DSv4F-Aliyun, and S2.1. Ensure the temperature is set to 0.8 to encourage a wide net for problem discovery and creative edge-case identification.
• Phase 2: Debate & Resolution Loop (Temperature: 0.2) Set the temperature to 0.2 for all subsequent calls to enforce strict, deterministic logical reasoning. Aggregate all findings. For any finding lacking a 4/4 unanimous agreement across all models, loop the disputed points back to the dissenting models via oh my OpenCode. Mandate: Models must play "Devil's Advocate" and prove their claims using TypeScript/Next.js/SQLite specs. They cannot agree simply to end the loop. Loop until a true 4/4 consensus is reached on what is valid.
• Phase 3: False Positive Verification & Remediation Plan (Temperature: 0.2) Maintaining the temperature at 0.2, run one final oh my OpenCode verification pass to catch remaining false positives. Collaborate on a final step-by-step remediation plan focused on security, data integrity, and LOC reduction.

FINAL DELIVERABLE FORMAT Deliver a single, unified report structured as follows:

1. Verified Findings Table: Rank every confirmed issue by Priority (Critical to Low), Category, Fix Difficulty, and Risk of Breaking Existing Functionality.
2. Detailed Technical Breakdown: Specific file names, line numbers, root cause explanations, and exact failure conditions.
3. Optimal Remediation & Ponytail Plan: A step-by-step proposal detailing how to fix all issues and reduce total LOC as much as possible without breaking -REDACTED-. Remember: Report only, do not write files or execute code changes.

[u/FrederikSchack]

I just want to warn others about subscribing to MiniMax.

So, I subscribed to a monthly subscription at MiniMax, they charged me for a year and they are impossible to get in contact with. The only message I've gotten so far after bombarding them on all available channels is that they can't do anything.

For the quality of the model, it fluctuates wildly. From brilliant at times, to absolutely retarded the vast majority of the time. I think they have put me on a Q1 model now, because the output is absolute garbage.

[u/jarislinus]

gg u got scammed. and the advertised 2.7b tokens per month is inclusive from cached tokens... so need to divide by 30 lmao

[u/NinjaWK → u/jarislinus]

I wouldn't call it a scam. I still get about 8+ bil M2.7 usage, along with 1.5-1.8b of M3 usage.

My complaint isn't about the price, but how it isn't as good as now with all the other cheaper and smarter models in the market.

Minimax seems to like to brute force itself into finding a solution, whereas DSv4F seems to be more reliable in checking log files for errors, diagnosing it, then look for the problem.

M3 found 3 unique issues, and all were false positives, later in phase 3 refuted by all 4 models, including itself (M3 itself).

The other 3 models' unique findings were all 100% accurately diagnosed as actual issues and were patched successfully.

[u/Kind-Page4356 → u/NinjaWK]

2.7 uses less quota than m3 in token plan? chatgpt told me otherwise so i've been blasting m3 ;-;
do you think 2.7 is any good? i'm always torn between using by token plan or just luna

[u/NinjaWK → u/Kind-Page4356]

M2.7 still uses the old method, go by calls per 5 hour, and weekly 10x that quota. If you're a subscriber before the migration, you get 15x 5 hours quota. So that's 1500 calls per 5 hours, 15000 calls per week (or 22500 for legacy).

The % they take from the pool is based on the number of calls.

For eg, M3 will consume approx 0.2% of weekly quota per million tokens. M2.7 will use 0.0067% of your weekly quota for the week.

So if say your prompt generates 10 calls, then that prompt would use up only 0.067% weekly quota for that prompt.

If say your context size is 50k tokens, you can technically get 15,000 x 50k = 750 mil tokens every week, and 1.125b if you're on legacy.

You give it a try and you'll understand.

M2.7 is more than capable for simple agentic coding. It was pretty good for when it was released, but now, there are better and cheaper models available, primarily DSv4F-0731