feat(provider): add minimax provider for MiniMax Token Plan models

[ferminquant]

Feature request: add minimax provider for MiniMax Token Plan models

Summary

Add a new clawpatch provider named minimax that calls the MiniMax
OpenAI-compatible chat completions endpoint directly via fetch(). This
unblocks clawpatch users with a MiniMax Token Plan (or any other
minimax/MiniMax deployment) when their default provider (codex) is
unavailable or rate-limited, or when they prefer to use minimax/MiniMax for
reviews.

Motivation

• The current codex default requires a local Codex CLI. Users who do
  not have Codex installed or authenticated have to fall back to acpx
  (which routes through openclaw) or to one of the other local CLI
  providers.
• MiniMax exposes an OpenAI-compatible chat completions API at
  https://api.minimax.io/v1/chat/completions with stable schema-enforced
  output via response_format.json_schema. This is a clean fit for
  clawpatch's per-call provider contract.
• clawpatch today has 9 supported providers (codex, acpx, claude,
  cursor, grok, opencode, pi, mock, mock-fail). Adding
  minimax covers a different distribution and is a real maintenance
  burden shared with maintainers.

Proposed approach

Add a new minimax provider in src/provider.ts that:

• Reads the API key from MINIMAX_API_KEY env var.
• POSTs to ${MINIMAX_BASE_URL:-https://api.minimax.io/v1}/chat/completions
  with model, messages, and response_format: {type: "json_schema", ...}.
• Selects model via --model <name> (default MiniMax-M3).
• Honors CLAWPATCH_MINIMAX_TIMEOUT_MS and CLAWPATCH_PROVIDER_TIMEOUT_MS
  for the per-call timeout.
• Surfaces MiniMax-specific failure messages for 401/403/429.
• Falls back to grokEnvelopeText-style envelope probing if the response
  shape is non-standard.

A reference implementation is available on the fork at
ferminquant/clawpatch on branch feat/minimax-provider.

Configuration

Env var	Required	Default	Purpose
MINIMAX_API_KEY	yes	—	Token Plan API key (sk-cp-…)
MINIMAX_BASE_URL	no	https://api.minimax.io/v1	Override the endpoint
MINIMAX_MODEL	no	MiniMax-M3	Default model
CLAWPATCH_MINIMAX_TIMEOUT_MS	no	300000	Per-call timeout
CLAWPATCH_PROVIDER_TIMEOUT_MS	no	300000	Fallback timeout

Endpoints

• POST /chat/completions — review, fix, revalidate, map
• GET /models — connectivity check (used by check())

Verification on the reference implementation

• pnpm typecheck — clean
• pnpm lint — clean (1 unused-param warning fixed by renaming to _root)
• pnpm format:check — clean (after pnpm format)
• pnpm test src/provider.test.ts — 146/146 passing (135 pre-existing + 11 new)
• pnpm build — clean
• Live test: providerByName("minimax").check(...) against the real
  /v1/models endpoint with a Token Plan key returns
  provider=minimax default-model=MiniMax-M3 base=https://api.minimax.io/v1
• End-to-end review run against feat_library_d4f04bd776 (a real
  feature in ferminquant/budget) completed in 4m07s and produced 5
  schema-valid findings.

The full test suite has 19 pre-existing failures in src/workflow.test.ts
that are unrelated to this change (verified by stashing the changes and
re-running the same test).

Labels

• enhancement — new feature
• help wanted — community contribution welcome
• impact:other — provider routing / model choice
• merge-risk: 🚨 auth-provider — touches the auth/credentials surface
• documentation — README provider list needs updating

[clawsweeper]

Codex review: keeping this open for maintainer follow-up; there is still a little grit to resolve. Reviewed June 10, 2026, 6:31 PM ET / 22:31 UTC.

Summary
Keep open: current main and v0.5.0 do not provide MiniMax routing, and the linked implementation remains open and conflicted. The feature still requires maintainer approval because it would establish a new first-party API-key, endpoint, model, timeout, and runtime-dependency contract.

Reproducibility: not applicable. this requests a new provider and configuration surface rather than reporting broken existing behavior. Source and documentation inspection clearly establish that current main lacks the requested provider.

Ways to help us reproduce this

• Add a screenshot or short recording showing the behavior.
• Add expected vs actual behavior.
• Include redacted logs or terminal output.

Next step
Do not create a second repair branch because the same author already has an open closing PR; maintainers should resolve its conflict and decide whether to accept the provider surface.

Review details

Best possible solution:

Refresh and review #126 against current main, then merge it only if maintainers accept MiniMax as a core provider and the final branch preserves schema validation, redacted credential handling, explicit unsupported-fix behavior, synchronized documentation, and focused provider tests.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this requests a new provider and configuration surface rather than reporting broken existing behavior. Source and documentation inspection clearly establish that current main lacks the requested provider.

Is this the best way to solve the issue?

Unclear pending maintainer approval: extending the existing Provider interface is repository-native, and the linked PR provides useful runtime evidence, but making a service-specific direct HTTP provider part of core remains a product and maintenance decision.

AGENTS.md: found and applied where relevant.

Remaining risk / open question:

• The linked PR conflicts with current main, so its final merge result and compatibility with recent provider changes have not been established.
• Accepting the proposal makes MiniMax credentials, endpoint/model defaults, supported-operation limitations, a long network timeout, and an additional runtime dependency part of the maintained core provider surface.

Codex review notes: reasoning high; reviewed against 637d2bd1cf81.

Label changes

Label changes:

• remove clawsweeper:linked-pr-open: Current issue advisory state no longer selects this label.

Label justifications:

• P2: This is a concrete, bounded provider enhancement with an active implementation PR, but it is not an urgent regression.
• impact:auth-provider: The requested capability adds API-key authentication, model selection, endpoint configuration, and provider routing.

Evidence reviewed

What I checked:

• Provider absent from current main: The current dispatcher supports codex, opencode, acpx, grok, pi, cursor, claude, and test providers, but has no minimax case and rejects unknown names. (src/provider.ts:266, 637d2bd1cf81)
• Documentation lacks MiniMax: The supported-provider documentation on current main does not list MiniMax. (README.md:120, 637d2bd1cf81)
• Implementation PR remains open: The linked closing pull request is open at feat(provider): add minimax provider for MiniMax Token Plan models #126 and GitHub currently reports its merge result as CONFLICTING/DIRTY, so it is not an implemented fix. (894826cf4eb2)
• Linked PR has positive runtime evidence: The linked PR reports live model-endpoint, authentication-failure, schema-valid review, and long-response timeout evidence; its latest ClawSweeper review marks proof sufficient while retaining the core-provider product decision. (894826cf4eb2)
• Latest release predates the request: The v0.5.0 release commit contains the provider architecture but no MiniMax implementation, and current main has not subsequently added one. (src/provider.ts:257, d407835d91c7)

Likely related people:

• steipete: The Provider interface, dispatcher, initial implementations, tests, and provider documentation trace to the v0.5.0 repository baseline. (role: introduced provider architecture; confidence: high; commits: d407835d91c7; files: src/provider.ts, src/provider.test.ts, README.md)
• coletebou: Recently merged work changed review-output verification in the central provider path and associated tests. (role: recent provider-output contributor; confidence: medium; commits: 13b10bcb95a0; files: src/provider.ts, src/provider.test.ts)
• vincentkoc: Recently merged revalidation work touched the provider workflow and linked-patch evidence behavior. (role: recent provider-workflow contributor; confidence: medium; commits: 54d5d704aab7; files: src/provider.ts, src/provider.test.ts)

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Landed in 7252f7300f348629d77c6ba18575fae2938edd31.

Verification before merge:

pnpm typecheck
pnpm lint
pnpm format:check
pnpm test
pnpm build
pnpm pack:smoke

Local results:

Vitest: 825 passed, 1 skipped
pack:smoke: packaged CLI smoke mapped 13 features, 3 CUDA

Autoreview closeout:

autoreview clean: no accepted/actionable findings reported

Required GitHub Actions on head 05fba5cfe77873e243a16f583a07211519b2473f were all green:

CI: success
CodeQL: success
Dependency Review: success
Security Gate: Secret Scanning: success

Live MiniMax proof remains release-only blocked in this environment: exact MINIMAX_API_KEY check returned missing, and no targeted 1Password item or field was provided. Per maintainer clarification, that did not block merge; it blocks publishing a release until a redacted live /models check plus one schema-valid supported operation is run against the exact release commit.