feat(provider): add acpx provider for any ACP-compatible coding agent

[mvanhorn]

Summary

• Adds an acpx provider that routes clawpatch review / fix / revalidate through openclaw/acpx, so any ACP-compatible coding agent (Codex, Claude, Pi, Gemini, OpenClaw ACP) can back a clawpatch run behind one provider name. Defaults to codex as the underlying agent so existing users keep the same behavior; pick a different agent via --model claude, --model pi, or --model claude:sonnet-4-5.
• One new branch in providerByName plus a small helper trio (runAcpxJson, buildAcpxPrompt, extractAcpxJson) in src/provider.ts. No new runtime dependencies; acpx is a peer CLI like codex.
• New runCommandRaw in src/exec.ts preserves full stdout for stream-protocol consumers. The existing runCommand keeps its 8 KB trimOutput for short-output CLIs, so codex/mocks are unaffected. acpx's --format json --json-strict emits 200+ NDJSON envelopes per prompt, which would be corrupted by truncation.
• Permission model is documented honestly. acpx --approve-all is a permission-prompt auto-approver, not an enforced sandbox like codex --sandbox workspace-write. For review / revalidate (--deny-all), the provider also embeds an explicit READ-ONLY directive in the prompt body, and docs/safety.md is updated to reflect that the read-only guarantee for the acpx path depends on the underlying agent's cooperation.
• NDJSON parser reads agent_message_chunk, agent_thought_chunk, and tool_call_result envelope kinds so the provider works for agents that route final structured output differently (Claude can land it in thought chunks; some configs use tool-call returns). On extraction failure, the diagnostic names the envelope kinds it observed, so an acpx version-shape change surfaces as a clear "envelope shape may have changed" error rather than a silent malformed-output.

Why this matters

The README at line 79 and docs/providers.md line 42 both call out that "Direct OpenAI, Claude, Gemini, and provider panels are not implemented yet." The cheapest path to closing that gap is not to write a Claude provider, a Gemini provider, and a Pi provider one at a time, but to route through openclaw/acpx (the org's existing headless ACP client). This is the same pattern openclaw/mcporter uses for MCP servers: one CLI surface for a whole protocol family.

Selection syntax uses last-colon split on model, so model identifiers that contain colons work cleanly:

model value	Agent	Model
(null / unset)	codex	agent default
claude	claude	agent default
claude:sonnet-4-5	claude	sonnet-4-5
pi	pi	agent default
ollama:llama3:70b	ollama:llama3	70b

Migration: --provider codex --model X is NOT equivalent to --provider acpx --model X (the latter selects an agent named X). The correct migration is --provider acpx --model codex:X. docs/providers.md has a dedicated migration note.

Demo

Simulated demo:

Empirical validation from the dogfood run: acpx --cwd <root> --deny-all --format json --json-strict codex exec --file <prompt> against a clawpatch review-shaped prompt embedding reviewJsonSchema returned schema-conforming JSON on first try. 256 NDJSON lines, ~19s, concatenated agent_message_chunk.content.text parsed cleanly into {findings, inspected}.

Testing

• corepack pnpm typecheck
• corepack pnpm lint
• corepack pnpm test — 126 tests pass; new src/provider.test.ts covers extractAcpxJson for codex / claude (thought-chunk) / tool-call shapes, json fence stripping, prose-preamble tolerance, the malformed-output diagnostic paths, and a 256-line NDJSON fixture >8KB as a regression guard for the runCommandRaw path.
• Manual dogfood (recorded in the simulated demo above): the acpx provider returned schema-conforming JSON on a fixture repo without contacting Codex.

[mvanhorn]

Thanks for landing the acpx provider, @steipete. ACP-compatible coverage in clawpatch is a real unlock.