fix: wire Devin manual auth through the CLI on Linux

[Waseemilyas]

Fixes the Devin CLI config path as well as the Linux platform gate. A configured manual bearer token previously never reached the provider's typed settings, so exempting prebuilt settings in the gate alone did not make the CLI work.

Devin now reads manual auth and organization through the existing descriptor credential adapter. Availability, the Linux gate, and the request share token precedence. Only a usable token in manual mode permits Linux quota requests; automatic browser import remains macOS-only. An empty primary environment override continues to shadow fallback values.

The regression decodes real provider config, checks the resulting settings, and exercises the existing fetcher with a synthetic HTTP transport. It verifies the final organization URL, Authorization header, and daily/weekly result. Linux CI also checks both Auto/Web CLI source modes, explicit Auto/Off auth, and empty overrides using those config-derived settings.

Validation so far: the original proposal failed the config-to-settings regression; 26 existing Devin tests and four new tests (eight cases) pass locally. make check is clean and independent P0–P2 review found no actionable defects. Full make test passed all 1,060 selections across 89 groups on the first attempt, with no retries or timeouts (954.4 seconds). Exact-head CI passed all Linux x64, Linux ARM64, musl and macOS checks. The Linux x64 log confirms all eight new config/request cases executed successfully. Merged as c9f2eca8da03b525f097e89f6b98a55fed96b9fd.

Includes Linux setup documentation and an Unreleased changelog entry. Thanks @Waseemilyas for the original Linux-gate fix.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-10T19:15:47.325232Z	3156d5d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3156d5da37

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 10, 2026, 4:51 PM ET / 20:51 UTC (Revision 3).

ClawSweeper review

What this changes

Connects Devin’s configured bearer token and organization to CLI requests, enables manual authentication on Linux, and adds regression coverage and setup documentation.

Merge readiness

⛔ Blocked before merge - 2 items remain

The PR remains useful: current main and v0.58.0 still lack the working CLI path. The earlier settings-wiring finding is resolved, with no new actionable defect found; real Linux behavior proof remains outstanding.

Priority: P2
Reviewed head: 1b9914ba17531a166db31411d0af1f9bf746ff0d

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The focused patch resolves the earlier defect and has useful regression coverage, but real runtime evidence remains a merge gate.
Proof confidence	🦪 silver shellfish (2/6)	Needs real behavior proof before merge: Needs real behavior proof before merge: the config adapter and quota fetcher are exercised with synthetic HTTP responses, but no after-fix Linux CLI run shows actual daily and weekly usage. The previous transcript request remains unresolved. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: Needs real behavior proof before merge: the config adapter and quota fetcher are exercised with synthetic HTTP responses, but no after-fix Linux CLI run shows actual daily and weekly usage. The previous transcript request remains unresolved. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	7 items	Applicable repository policy: Read the complete root AGENTS.md; no nested AGENTS.md files or maintainer-notes directory were present. Applied guidance on descriptor reuse, focused provider tests, provider isolation, and avoiding live credential probes. Builds and tests were not executed under the read-only review contract. Earlier finding resolved: The descriptor now supplies a credentialSettings adapter, which TokenAccountCLI.settingsSnapshot consumes through credentialContribution. The Linux exemption, strategy availability, and fetch all use the same token precedence. This addresses the earlier review at #3541 (comment). Current main still needs the repair: Fetched main still registers Devin without a credential reader or browser-support exemption. The registration’s default credential reader returns nil, so the CLI cannot construct Devin settings from configured manual credentials.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar’s CLI translates provider configuration and environment overrides into usage requests. The Devin provider sends those credentials to its quota endpoint and returns daily and weekly usage.

flowchart TD
  A[Provider configuration] --> C[Devin settings adapter]
  B[Environment overrides] --> D[Manual authentication gate]
  C --> D
  D -->|Manual token available| E[Devin quota request]
  D -->|Unavailable on Linux| F[Unsupported source response]
  E --> G[Daily and weekly usage]

Loading

Before merge

• Add real behavior proof - Needs real behavior proof before merge: Needs real behavior proof before merge: the config adapter and quota fetcher are exercised with synthetic HTTP responses, but no after-fix Linux CLI run shows actual daily and weekly usage. The previous transcript request remains unresolved. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Complete next step (P2) - Add an after-fix Linux CLI transcript showing manual authentication returning real Devin usage; terminal screenshots or recordings are welcome, and copied output or logs also count. Redact tokens, organization identifiers, IP addresses, and other private details. Update the PR body to trigger re-review; if it does not run, ask a maintainer to comment @clawsweeper re-review.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	production +18 net lines; tests +107 lines	The production growth wires existing configuration into the CLI and is accompanied by config-derived request and platform-gate coverage.

Technical review

Best possible solution:

Keep Devin on the existing descriptor-owned credential path, preserving manual-mode selection, environment precedence, and macOS-only browser import.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: current main’s CLI receives no Devin credential contribution and rejects its web-backed source on Linux. No runtime reproduction was executed during this read-only review.

Is this the best way to solve the issue?

Yes. Reusing the existing credential adapter and sharing token resolution repairs both missing connections without adding a competing authentication mechanism.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against cebf9995f672.

Labels

Label justifications:

• P2: This repairs a bounded provider CLI authentication path without evidence of a broader urgent regression.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Needs real behavior proof before merge: the config adapter and quota fetcher are exercised with synthetic HTTP responses, but no after-fix Linux CLI run shows actual daily and weekly usage. The previous transcript request remains unresolved. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Applicable repository policy: Read the complete root AGENTS.md; no nested AGENTS.md files or maintainer-notes directory were present. Applied guidance on descriptor reuse, focused provider tests, provider isolation, and avoiding live credential probes. Builds and tests were not executed under the read-only review contract. (AGENTS.md:1, 1b9914ba1753)
• Earlier finding resolved: The descriptor now supplies a credentialSettings adapter, which TokenAccountCLI.settingsSnapshot consumes through credentialContribution. The Linux exemption, strategy availability, and fetch all use the same token precedence. This addresses the earlier review at fix: wire Devin manual auth through the CLI on Linux #3541 (comment). (Sources/CodexBarCore/Providers/Devin/DevinProviderDescriptor.swift:19, 1b9914ba1753)
• Current main still needs the repair: Fetched main still registers Devin without a credential reader or browser-support exemption. The registration’s default credential reader returns nil, so the CLI cannot construct Devin settings from configured manual credentials. (Sources/CodexBarCore/Providers/Devin/DevinProviderDescriptor.swift:19, cebf9995f672)
• Latest release comparison: The v0.58.0 descriptor also lacks the credential adapter and Linux manual-auth exemption; the latest supplied release does not contain this repair. (Sources/CodexBarCore/Providers/Devin/DevinProviderDescriptor.swift:19, 88fa2f45fa1e)
• Proof remains synthetic: The new test decodes config through the CLI settings owner and calls the real fetcher, but DevinRequestFixture supplies a fabricated HTTP 200 response. The complete supplied body reports tests and CI, with no real Linux quota result. A REST read confirmed the same body and pinned head; the earlier completed review’s transcript request remains applicable. (TestsLinux/DevinCLISettingsTests.swift:39, 1b9914ba1753)
• Credential destination and failure handling: The existing fetcher sends the selected bearer token to the fixed https://app.devin.ai origin, treats HTTP 401/403 as invalid credentials, and does not fall back to browser sessions after a manual-auth failure. The patch adds no credential persistence, alternate host, or dependency change. (Sources/CodexBarCore/Providers/Devin/DevinUsageFetcher.swift:175, 1b9914ba1753)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Provide a redacted after-fix Linux CLI transcript showing configured manual authentication returning daily and weekly usage.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-09-10T19:57:51.216Z sha 3156d5d :: needs real behavior proof before merge. :: [P1] Wire production Devin settings into the new exemption
• reviewed 2026-09-10T20:40:00.248Z sha 1b9914b :: needs real behavior proof before merge. :: none

[steipete]

Merged as c9f2eca. The fix covers the missing descriptor credential reader as well as the Linux gate, so manual bearer and organization config reaches the actual fetcher. Availability, the platform gate and requests now share token precedence; automatic browser import remains macOS-only.

The new regression failed on the proposal before the config reader was added. Final validation passed: 26 existing Devin tests, four new config/request tests with eight cases, all 1,060 full-suite selections with no retries/timeouts, lint, independent P0–P2 review and every Linux/musl/macOS CI check. The Linux x64 log confirms the config-derived gate and synthetic final-request cases ran successfully.

Linux setup docs and the Unreleased changelog are updated. Thanks @Waseemilyas!