fix(devin): bind alias tenant host to credential key

[luvs01]

Motivation

• Close a credential/host identity gap where an alias-derived tenant host could be selected without ensuring the transmitted API key belonged to that alias credential.
• Prevent cross-account or cross-region exposure of long-lived Devin keys when a devin/devin-cli rekey window and separately-sourced keys coexist.

Description

• Add an optional apiKey parameter to resolveDevinApiServer and require the alias credential to access === apiKey before borrowing its apiBaseUrl in src/oauth/devin.ts.
• Pass the resolved adapter key into resolveDevinApiServer from src/adapters/devin.ts so host and key are resolved as a bound snapshot.
• Add a regression test in tests/providers/devin-adapter.test.ts that proves an independently configured key cannot borrow an alias slot's tenant host, and update tests/providers/devin-login.test.ts to exercise the new binding.
• Document the invariant in structure/runtime.md and structure/providers-and-adapters.md to declare that alias-host fallback is only allowed when the alias credential owns the transmitted key.

Testing

• Ran bun test tests/providers/devin-adapter.test.ts tests/providers/devin-login.test.ts and both focused test files passed (66 tests total).
• Ran bun run typecheck, bun run structure:check, and bun run privacy:scan, all of which succeeded.
• Ran bun test tests/ci-workflows/file-size-ratchet.test.ts which passed its checks.
• A full bun run test execution in this container produced unrelated environment/timing and process-group failures (focused Devin coverage passed; full run: 27,761 passed, 34 skipped, 181 failed, 2 errors) so only the focused Devin tests are relied on for regression verification.

---

Codex Task

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c41fb60e-c9b8-4a26-900b-c626d478bedf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T00:27:27.359415Z	d225fc2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[luvs01]

Consolidated into lidge-jun#5541 as a single related-function aggregate.

Source head: d225fc2b6bb507943a8b494b0c3ced0f97def0f6. Replacement head: 6f2901b117b6d8a9a7eae503e795b74749b6e7e0.

All unique Devin contribution commits are carried with original authors and provenance. Six match complete stable patch IDs; the alias-host change matches the code/test/runtime-document patch IDs and its one table-row conflict preserves both contracts. The common f700c56 role-fixture change is already present in both corresponding provider objects on the base, so it was not duplicated. Integration regressions verify exact 429 timing, no raw credential reflection, one physical send, and the alias-bound EU tenant path. Devin tests: 252 passed; layout:18 passed; ratchet:9 passed; typecheck/structure/privacy passed. Full cross-platform CI and independent review remain pending.

Closing this duplicate standalone review entry at the author's request after verifying migration. This is not a merge or release claim; remaining integration checks and reviews are tracked on the draft replacement. Original branches are retained.