docs: fix download banners and clarify CLI data directories

README.md

@@ -78,7 +78,7 @@ mcode login --region global
 
 Complete sign-in in your browser, then open `mcode` and use `/status` to check your account and `/provider` to choose a model. Run `mcode logout` to sign out.
 
-Token Plan requires an account with available credits. User data is stored in `~/.minimax-code` by default.
+Token Plan requires an account with available credits. The published npm CLI `@minimax-ai/code@0.4.12` defaults to `~/.minimax` for user data; builds from this repository default to `~/.minimax-code`. `MINIMAX_DATA_DIR` or `MAVIS_DATA_DIR` can override the data directory. The installer's `~/.minimax-code` installation directory is separate from this choice. See [Accounts and data](docs/installation.md#accounts-and-data) before locating or removing configuration and sessions.
 
 <details>
 <summary>Use your own API key (BYOK)</summary>
@@ -197,7 +197,9 @@ For now, code and documentation pull requests are accepted only from repository
 
 ## Desktop app and support
 
-<img src="https://filecdn.minimax.chat/public/c3ebbd2e-f55b-48d7-adff-030abb63e06d.png" alt="MiniMax Code desktop app" width="100%" />
+<a href="https://agent.minimax.io/download" title="Download MiniMax Code">
+  <img src="https://filecdn.minimax.chat/public/c3ebbd2e-f55b-48d7-adff-030abb63e06d.png" alt="MiniMax Code desktop app — click to download" width="100%" />
+</a>
 
 [Download for macOS or Windows](https://agent.minimax.io/download) · [Report a problem or ask a question](https://github.com/MiniMax-AI/minimax-code/issues/new/choose)
 

README_ZH.md

@@ -78,7 +78,7 @@ mcode login --region global
 
 在浏览器中完成登录，再启动 `mcode`，通过 `/status` 检查账号、通过 `/provider` 选择模型。退出登录使用 `mcode logout`。
 
-Token Plan 需要账号与可用额度。默认用户数据保存在 `~/.minimax-code`。
+Token Plan 需要账号与可用额度。已发布的 npm CLI `@minimax-ai/code@0.4.12` 默认将用户数据保存在 `~/.minimax`；从本仓库构建的版本默认为 `~/.minimax-code`。`MINIMAX_DATA_DIR` 或 `MAVIS_DATA_DIR` 可以覆盖数据目录。安装脚本使用的 `~/.minimax-code` 安装目录与数据目录的选择是两回事。查找或删除配置和会话前，请参阅[账号与数据](docs/installation.md#accounts-and-data)。
 
 <details>
 <summary>使用自己的 API Key（BYOK）</summary>
@@ -197,7 +197,9 @@ node /absolute/path/to/minimax-code/dist/cli.js
 
 ## 桌面版与问题反馈
 
-<img src="https://filecdn.minimax.chat/public/c3ebbd2e-f55b-48d7-adff-030abb63e06d.png" alt="MiniMax Code 桌面版" width="100%" />
+<a href="https://agent.minimaxi.com/download" title="下载 MiniMax Code">
+  <img src="https://filecdn.minimax.chat/public/c3ebbd2e-f55b-48d7-adff-030abb63e06d.png" alt="MiniMax Code 桌面版 — 点击下载" width="100%" />
+</a>
 
 [下载 macOS 或 Windows 桌面版](https://agent.minimaxi.com/download) · [报告问题或提问](https://github.com/MiniMax-AI/minimax-code/issues/new/choose)
 

SECURITY.md

@@ -10,7 +10,7 @@ Include the affected version, operating system and Node.js version, a minimal re
 
 ## Data and service boundaries
 
-- The default data directory, `~/.minimax-code`, stores login state, provider configuration, and sessions. It is not shareable project configuration. Restrict local access and keep it out of Git.
+- The active data directory stores login state, provider configuration (including API keys in `config.yaml`), and sessions. The published npm CLI `@minimax-ai/code@0.4.12` defaults to `~/.minimax`; builds from this repository default to `~/.minimax-code`. Environment overrides can select another directory. Follow [Accounts and data](docs/installation.md#accounts-and-data) to identify it; the installer location alone does not identify stored credentials. Restrict local access to every data directory you have used and keep them out of Git, including old profiles. They are not shareable project configuration.
 - Models, official plugins, connectors, search, media, feedback, and telemetry may contact external services. Those services continue to control authorization and credits; source access does not grant access to accounts or third-party resources.
 - mcode-tools obtains short-lived access tokens through the host's lease broker. Never pass refresh tokens to tool processes.
 - Permissions and sandboxing do not replace review of untrusted plugins, MCP servers, and shell commands. If automatic permission classification is unavailable, retain user confirmation rather than allowing operations by default.

docs/installation.md

@@ -39,7 +39,24 @@ On Windows, also use `node` with the appropriate local absolute path. Do not ove
 
 Run `/login` in the TUI or `pnpm mcode login`, choosing the region for your account. Token Plan requires an account and available credits. See the root README for BYOK configuration and testing.
 
-The default data directory is `~/.minimax-code`. For tests, explicitly set `MINIMAX_DATA_DIR` to a temporary directory to keep normal sessions separate. Use `$env:MINIMAX_DATA_DIR = 'C:\path\to\test-profile'` in PowerShell or `export MINIMAX_DATA_DIR=/path/to/test-profile` in a POSIX shell.
+Data-directory defaults depend on the artifact you run:
+
+| CLI artifact | Default user data directory |
+| --- | --- |
+| Published npm `@minimax-ai/code@0.4.12` | `~/.minimax` |
+| Build from this repository | `~/.minimax-code` |
+
+The npm 0.4.12 default was checked against the [public registry artifact](https://registry.npmjs.org/@minimax-ai/code/0.4.12) on 2026-09-19, with its SHA-512 integrity verified. This applies to that published version, including local npm dependencies; do not infer the default of another release from its version label alone. The source default is defined in [`data-dir.ts`](../packages/tui/src/runtime/data-dir.ts). Login state, provider configuration such as `config.yaml`, caches, and sessions belong to the selected data directory.
+
+Both accept a non-empty `MINIMAX_DATA_DIR`, falling back to a non-empty `MAVIS_DATA_DIR`, before the default. The [macOS / Linux / WSL installer](https://filecdn.minimax.chat/public/install.sh) installs the npm package under `~/.minimax-code` by default (`MCODE_INSTALL_DIR` changes the installation location). It does not set either data-directory override. Installation files and user data are separate concerns, even when their directories have the same name.
+
+To locate data safely:
+
+1. Identify the launcher you actually use with `command -v mcode` (POSIX) or `Get-Command mcode -All` (PowerShell), and run that launcher's `--version`. For a local npm dependency, use `node_modules/.bin/mcode --version`; a global npm listing does not identify it. A source build may report the same version as the npm release.
+2. Check whether either data-directory override is set in that launcher's environment. Otherwise use the artifact-specific default above. Inspect directory and file names/permissions locally, without printing `config.yaml`, authentication files, or session contents. For builds from this repository, `mcode telemetry status` also reports the selected `configFile` path without printing credentials; npm 0.4.12 does not provide that command.
+3. If both directories exist, their presence alone does not identify the active one. Keep both protected, and include the launcher, version, installation method, and whether overrides are set when requesting help. Redact personal path components; do not attach configuration or authentication files. Changing an override does not migrate existing data, so do not move or delete either directory merely to match these docs.
+
+For tests, explicitly set `MINIMAX_DATA_DIR` to a temporary directory to keep normal sessions separate. Use `$env:MINIMAX_DATA_DIR = 'C:\path\to\test-profile'` in PowerShell or `export MINIMAX_DATA_DIR=/path/to/test-profile` in a POSIX shell.
 
 ## Update or remove
 

docs/telemetry.md

@@ -4,7 +4,7 @@ All automatic telemetry uploads are disabled by default and each requires its ow
 
 ## Turn it on or off
 
-Add this to the active profile's `config.yaml`, normally `~/.minimax-code/config.yaml`, then restart MCode:
+Add this to the active profile's `config.yaml`, then restart MCode. Builds from this repository default to `~/.minimax-code/config.yaml`; the published npm CLI `@minimax-ai/code@0.4.12` defaults to `~/.minimax/config.yaml`. Overrides can change this path; see [Accounts and data](installation.md#accounts-and-data) to locate it. The telemetry controls below describe this repository's source build and are not a guarantee of feature parity with that npm release.
 
 ```yaml
 telemetry: