feat(provider): add minimax provider

Add the MiniMax provider with supported map, review, revalidate, and check operations. The provider refuses fix before network or filesystem side effects because MiniMax chat completions cannot edit a worktree.

Also repair package smoke so local runtime dependencies are packed as publish artifacts before installation, matching the package artifact path used by consumers.

Verification:

pnpm typecheck
pnpm lint
pnpm format:check
pnpm test
pnpm build
pnpm pack:smoke

GitHub Actions on head 05fba5c:

CI: success
CodeQL: success
Dependency Review: success
Security Gate: Secret Scanning: success

Co-authored-by: Fermin Quant <ferminquant@gmail.com>

Author: ferminquant

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.5.2 - Unreleased
+
+- Added a MiniMax HTTP provider for `map`, `review`, and `revalidate`, with local schema validation and explicit unsupported `fix` handling, thanks @ferminquant.
+
 ## 0.5.1 - 2026-06-10
 
 - Added npm trusted publishing through GitHub Actions OIDC, plus secops ownership, verified-secret scanning, and stale issue and pull request automation.

README.md

@@ -124,6 +124,7 @@ Supported provider names today:
 - `claude`: local Claude Code CLI in print mode
 - `cursor`: local Cursor Agent CLI (experimental; `doctor` is enabled by default)
 - `grok`: local Grok Build CLI
+- `minimax`: MiniMax OpenAI-compatible HTTP API; supports `map`, `review`, and `revalidate`, but not `fix`
 - `opencode`: local OpenCode CLI
 - `pi`: local Pi coding agent in print mode
 - `mock`: deterministic test provider

docs/providers.md

@@ -17,6 +17,7 @@ Provider names today:
 - `acpx`: routes through any ACP-compatible coding agent via `acpx`
 - `claude`: shells out to Claude Code in print mode (`claude -p`)
 - `grok`: shells out to the xAI Grok Build CLI in headless mode (`grok --prompt-file`)
+- `minimax`: calls the MiniMax OpenAI-compatible HTTP API directly
 - `opencode`: shells out to `opencode run --format json`
 - `pi`: shells out to `pi -p` (non-interactive print mode)
 - `cursor`: shells out to `cursor-agent -p --output-format json`
@@ -324,7 +325,54 @@ uses `--force` or `--yolo`. Complete HITL verification before promoting this to
 default provider support, especially for ambient rules, MCP configuration,
 temporary prompt file handling, timeout behavior, and any claimed read-only mode.
 
-Direct OpenAI API, local-model, and multi-model panel providers are not
-implemented yet. The `acpx` provider is the generic route for ACP-compatible
-agents; the `grok`, `opencode`, `pi`, and `cursor` providers are direct integrations
-for local CLIs.
+## MiniMax
+
+The `minimax` provider calls the MiniMax OpenAI-compatible HTTP API directly. It
+requires a Token Plan API key in `MINIMAX_API_KEY` and defaults to
+`https://api.minimax.io/v1`.
+
+```bash
+export MINIMAX_API_KEY=sk-cp-...
+clawpatch doctor --provider minimax
+clawpatch review --provider minimax
+clawpatch review --provider minimax --model MiniMax-M2.7-highspeed
+```
+
+How the MiniMax provider works:
+
+- Endpoint: `POST ${MINIMAX_BASE_URL:-https://api.minimax.io/v1}/chat/completions`
+  with `Authorization: Bearer ${MINIMAX_API_KEY}`. `MINIMAX_BASE_URL` is trimmed,
+  normalized, and must use `https` unless it targets loopback HTTP for local
+  development; the bearer token is sent to that configured endpoint.
+- Operations: `map`, `review`, and `revalidate` are supported. `fix` is not
+  supported because the chat completions API cannot edit the worktree; it fails
+  before checking credentials or making network calls with `unsupported-provider`
+  and exit code 2.
+- Structured output: MiniMax M-series Chat Completions do not document OpenAI
+  `response_format.json_schema` support. Clawpatch therefore sends the provider
+  schema in the prompt, disables M3 thinking with `thinking: {type: "disabled"}`,
+  asks for `reasoning_split`, extracts the returned JSON, and validates it
+  locally with the same Zod schemas used by other providers.
+- Model selection: `--model <name>` sets the request `model`; otherwise
+  `MINIMAX_MODEL` is used, then `MiniMax-M3`.
+- HTTP failures: `401` and `403` map to exit code 4, `429` maps to exit code 5,
+  and other non-2xx statuses map to exit code 1. Embedded MiniMax auth,
+  rate-limit, balance, and usage-limit status codes are mapped the same way.
+  Error bodies are reduced to safe status/type/code signals and byte counts.
+- Timeout: 30 minutes by default for provider calls, override with
+  `CLAWPATCH_MINIMAX_TIMEOUT_MS` or `CLAWPATCH_PROVIDER_TIMEOUT_MS`. The `/models`
+  doctor probe uses a 30-second timeout. Clawpatch uses a custom undici
+  dispatcher and an operation abort signal so socket headers/body timeouts and
+  full response-body reads track the configured timeout.
+- Bounds: request bodies over 64 MiB and responses over 10 MiB fail before
+  parsing; error bodies are capped separately.
+
+Permission caveat: MiniMax is a remote API provider. Review inputs are sent to
+the configured MiniMax endpoint, and read-only behavior depends on the remote
+model following the prompt. For untrusted code, run clawpatch in an isolated
+checkout and avoid sending secret-bearing files.
+
+Direct local-model and multi-model panel providers are not implemented yet. The
+`acpx` provider is the generic route for ACP-compatible agents; the `grok`,
+`opencode`, `pi`, and `cursor` providers are direct integrations for local CLIs;
+the `minimax` provider is a direct integration for the MiniMax HTTP API.

docs/spec.md

@@ -906,6 +906,7 @@ Implemented providers:
 - `claude`: Claude Code CLI in print mode.
 - `cursor`: experimental Cursor Agent CLI integration.
 - `grok`: Grok Build CLI.
+- `minimax`: MiniMax OpenAI-compatible HTTP API for map, review, and revalidate.
 - `opencode`: OpenCode CLI.
 - `pi`: pi coding agent.
 - `mock` / `mock-fail`: deterministic test providers.

package.json

@@ -30,6 +30,7 @@
     "crabbox:warmup": "crabbox warmup"
   },
   "dependencies": {
+    "undici": "^6.26.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {