Port Codex ACP vendor to new App Server adapter

[jsgrrchg]

Context

The current vendored Codex ACP runtime in NeverWrite is based on the Rust implementation from zed-industries/codex-acp and currently tracks v0.16.0 under vendor/codex-acp.

Upstream has now marked that implementation as legacy in practice. The latest commit on zed-industries/codex-acp only adds a README notice saying development is moving to agentclientprotocol/codex-acp, and recommends @agentclientprotocol/codex-acp for new installs.

Relevant upstream discussion:

• Timeline for the move to agentclientprotocol/codex-acp zed-industries/codex-acp#333
• Explanation comment: Timeline for the move to agentclientprotocol/codex-acp zed-industries/codex-acp#333 (comment)
• New adapter repo: https://github.com/agentclientprotocol/codex-acp

Ben Brandt explains there that the move consolidates Zed, JetBrains, and other teams around one implementation, uses the blessed Codex App Server path, avoids Rust/Codex binary distribution complexity, especially on Linux, and avoids maintaining two adapters in parallel.

Why this matters for NeverWrite

NeverWrite currently treats codex-acp as a bundled native sidecar:

• built from vendor/codex-acp/Cargo.toml
• staged into Electron under native-backend/binaries/codex-acp
• resolved by the native backend as the codex-acp runtime

The new upstream adapter is not a drop-in remote change. It is a TypeScript/Node adapter that runs Codex through Codex App Server and can be bundled into standalone executables with Bun. Replacing the remote/origin is not enough.

NeverWrite also carries product-specific behavior on top of the old adapter, especially around:

• inline review and change-control metadata
• edited-files buffer and accept/reject flows
• terminal output streaming metadata
• session resume/list/load behavior
• subagent/collab projection into the desktop UI
• status, plan, image generation, and review events
• auth setup for ChatGPT, OpenAI API key, and Codex API key

The new adapter already has equivalents for several of these concepts, including file changes with oldText/newText, review commands, terminal output, /goal, session resume, collab/subagent events, API key auth, ChatGPT auth, and gateway auth. However, the event and auth contracts differ from NeverWrite's current expectations.

Migration work

We should port NeverWrite to the new agentclientprotocol/codex-acp implementation deliberately, rather than continuing to invest in the deprecated Rust adapter.

Suggested approach:

1. Vendor the new adapter at an exact release/tag, likely starting with the latest stable agentclientprotocol/codex-acp tag.
2. Keep the old Rust vendor available during the spike, or migrate in a dedicated branch, so we can compare behavior safely.
3. Decide packaging strategy:
   • prefer a standalone codex-acp sidecar executable from the new adapter if practical, to preserve the existing Electron resource layout;
   • otherwise stage JS plus dependencies with embedded Node, similar to the Claude ACP runtime.
4. Update stage-electron-sidecar.mjs, release asset validation, smoke tests, and docs to build/stage the new runtime.
5. Add an auth translation layer:
   • NeverWrite chatgpt -> new ACP chat-gpt
   • NeverWrite openai-api-key / codex-api-key -> new ACP api-key with the expected _meta
   • evaluate whether Codex gateway auth should be exposed through NeverWrite's provider settings.
6. Adapt the native backend to consume the new adapter's metadata and events before patching the vendor.
7. Patch the vendored adapter only where NeverWrite needs a signal that cannot be reconstructed reliably in the backend.
8. Preserve the public NeverWrite runtime id codex-acp unless there is a strong migration reason to rename it.

Validation checklist

Before merging this migration, verify at minimum:

• Codex setup status detects existing ChatGPT auth and API-key auth correctly.
• ChatGPT terminal login still works.
• API-key sessions start without an extra prompt.
• session/new, session/load, session/list, and session/resume work.
• Inline review still creates review findings in the expected UI.
• Agent-edited files appear in the edited-files buffer.
• Accept/reject change flow still applies the expected hunks.
• Terminal output streams and exits correctly.
• Subagent/collab activity appears in the agent/session UI without stale running states.
• /review, /review-branch, /review-commit, /compact, and /goal behavior is covered.
• Packaged Electron app includes the new runtime and passes smoke tests on macOS, Linux, and Windows.

Notes

This should be treated as a runtime migration, not a small vendor bump. The old Rust implementation is effectively deprecated upstream, but NeverWrite's review and change-control surfaces are high-risk and should not be migrated by blind replacement.

[jsgrrchg]

With the arrival of gpt 5.6, this is urgent. Probably the acp will break when updating the runtime