@bitkyc08/opencodex 2.52.0-preview.20260911 → 2.52.0-preview.20260912

package/src/oauth/devin/types.ts

@@ -0,0 +1,71 @@
+/**
+ * Shared types for the OAuth login flow + persisted credentials.
+ *
+ * Two distinct token shapes appear in this codebase:
+ *
+ *  - `firebaseIdToken` — the short-lived JWT minted by Auth0 / Firebase Auth
+ *    during browser sign-in. Lives in the OAuth callback URL fragment/query.
+ *    Treated as opaque and discarded once exchanged.
+ *
+ *  - `apiKey` — the long-lived credential returned by
+ *    `SeatManagementService.RegisterUser`. Used inside every Cascade RPC's
+ *    `Metadata.api_key` field. Format is provider-defined:
+ *      * Cognition era:  `devin-session-token$<JWT>`
+ *      * Codeium classic: bare UUID v4
+ *      * Older Windsurf:  `sk-ws-01-<...>` / `cog_<...>`
+ *    The plugin treats it as an opaque string — only the cloud cares about format.
+ */
+
+export interface OAuthLoginResult {
+  /** The opaque API key used as `Metadata.api_key` in every Cascade RPC. */
+  apiKey: string;
+  /** Human-readable account name (`Satvik Kapoor`). */
+  name: string;
+  /**
+   * Cloud API server (`https://server.codeium.com`, `https://eu.windsurf.com/_route/api_server`,
+   * `https://windsurf.fedstart.com/_route/api_server`). Driven by the user's
+   * tenant — language_server needs this as `--api_server_url`.
+   */
+  apiServerUrl: string;
+  /** Optional cleanup redirect URL returned by RegisterUser. Informational. */
+  redirectUrl?: string;
+}
+
+export interface PersistedCredentials extends OAuthLoginResult {
+  /** ISO timestamp the credentials were minted at — purely informational. */
+  issuedAt: string;
+  /** Optional tag tracking the OAuth client id used (so a future client rotation can invalidate). */
+  oauthClientId: string;
+  /**
+   * True when these credentials were written as part of the
+   * `opencode auth login` → authorize() flow (so opencode's auth.json is the
+   * authoritative copy and `opencode auth logout windsurf` should mirror-clear
+   * this file). False / absent for credentials written by our standalone
+   * `opencode-windsurf-auth login` CLI; those survive opencode auth state
+   * changes.
+   */
+  syncedViaOpencodeAuth?: boolean;
+}
+
+export interface WindsurfRegion {
+  /** Where to send users for browser sign-in. */
+  website: string;
+  /** Where to POST RegisterUser. */
+  registerApiServerUrl: string;
+  /** Auth0 client id passed in the OAuth URL. */
+  oauthClientId: string;
+}
+
+/**
+ * The single tenant (free / personal) configuration. EU, FedStart, and arbitrary
+ * portal URLs override `website` + `registerApiServerUrl` at runtime when the
+ * user passes `--portal-url` to the login command.
+ */
+export const DEFAULT_REGION: WindsurfRegion = {
+  website: 'https://windsurf.com',
+  registerApiServerUrl: 'https://register.windsurf.com',
+  // From /Applications/Windsurf.app/.../extension.js — the public Windsurf
+  // Auth0 client. If Windsurf rotates this, sign-in will start failing until
+  // we re-extract it.
+  oauthClientId: '3GUryQ7ldAeKEuD2obYnppsnmj58eP5u',
+};

package/src/oauth/devin-cli.ts

@@ -0,0 +1,149 @@
+/**
+ * Devin CLI credential import.
+ *
+ * The installed CLI writes `credentials.toml` after `devin auth login`, and the
+ * `windsurf_api_key` in it is an ordinary `devin-session-token$<JWT>` — the same
+ * shape RegisterUser returns for `ocx login devin`, and the same one the
+ * cloud-direct client already speaks. Measured against a signed-in CLI: it mints
+ * a user_jwt, opens the full model catalog, and streams chat.
+ *
+ * So this is kiro's import-first login with the same substance: adopt a signed-in
+ * local CLI's own session rather than starting a browser flow the CLI already
+ * completed. No browser is ever opened, because there is nothing left for
+ * opencodex to authorize.
+ *
+ * The file also carries `devin_webapp_host` and `devin_api_url`, which belong to
+ * the Devin *session* product (`cog_` keys, agent VMs) rather than to model
+ * inference. Neither is read here.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+import { DEVIN_CLI_INSTALL_HINT } from "../adapters/devin-cli/binary";
+import { identityFromApiKey } from "./devin";
+import { resolveDevinApiBaseUrl } from "./devin/api-base";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+/**
+ * Structurally the `LoginOpts` from `./index`, restated here rather than imported.
+ * `index.ts` imports this module to register the provider, so importing the type
+ * back would close a cycle for one optional field this flow does not branch on:
+ * an import has nothing to force, so `forceLogin` is a no-op for it.
+ */
+type DevinCliLoginOpts = { forceLogin?: boolean };
+
+/** Absolute-path override, for a CLI installed somewhere this resolver does not model. */
+export const DEVIN_CLI_CREDENTIALS_ENV = "OPENCODEX_DEVIN_CLI_CREDENTIALS";
+
+export interface DevinCliLoginDeps {
+  env?: NodeJS.ProcessEnv;
+  platform?: NodeJS.Platform;
+  exists?: (path: string) => boolean;
+  read?: (path: string) => string;
+}
+
+/**
+ * Where the CLI keeps its own credential.
+ *
+ * Measured on a live install: `$XDG_DATA_HOME/devin/credentials.toml`, i.e.
+ * `~/.local/share/devin/...`, which `devin auth status` prints. Note this is the
+ * DATA dir, not the config dir — an earlier draft guessed `~/.config` and was
+ * wrong. The Windows branch mirrors the CLI's own installer.
+ */
+export function devinCliCredentialsPath(
+  env: NodeJS.ProcessEnv = process.env,
+  platform: NodeJS.Platform = process.platform,
+): string {
+  const override = env[DEVIN_CLI_CREDENTIALS_ENV]?.trim();
+  // Absolute only. A relative override would resolve against whatever directory
+  // the proxy happens to be running in, which is not a location a user can mean.
+  if (override && (override.startsWith("/") || /^[A-Za-z]:[\\/]/.test(override))) return override;
+  const paths = platform === "win32" ? win32 : posix;
+  if (platform === "win32") {
+    const appData = env.APPDATA ?? paths.join(homedir(), "AppData", "Roaming");
+    return paths.join(appData, "devin", "credentials.toml");
+  }
+  const dataHome = env.XDG_DATA_HOME ?? paths.join(homedir(), ".local", "share");
+  return paths.join(dataHome, "devin", "credentials.toml");
+}
+
+export interface DevinCliCredentialFile {
+  apiKey: string;
+  apiServerUrl: string;
+}
+
+/**
+ * Read the two keys that matter, and nothing else.
+ *
+ * The measured file is four flat `key = "value"` lines: no tables, no comments,
+ * no single quotes. A line matcher is therefore enough and a TOML dependency is
+ * not, and the quoted form is required rather than optional — an unquoted
+ * matcher would pass its own fixtures and miss the real file.
+ *
+ * Returns undefined rather than throwing so the caller owns the one error
+ * message. Nothing here ever puts the file's contents into a thrown value.
+ */
+export function readDevinCliCredentialFile(deps: DevinCliLoginDeps = {}): DevinCliCredentialFile | undefined {
+  const path = devinCliCredentialsPath(deps.env, deps.platform);
+  const exists = deps.exists ?? existsSync;
+  if (!exists(path)) return undefined;
+  let raw: string;
+  try {
+    raw = (deps.read ?? ((p: string) => readFileSync(p, "utf8")))(path);
+  } catch {
+    return undefined;
+  }
+  const apiKey = raw.match(/^\s*windsurf_api_key\s*=\s*"([^"]+)"/m)?.[1]?.trim();
+  const apiServerUrl = raw.match(/^\s*api_server_url\s*=\s*"([^"]+)"/m)?.[1]?.trim();
+  if (!apiKey || !apiServerUrl) return undefined;
+  return { apiKey, apiServerUrl };
+}
+
+/** True when a signed-in CLI credential is readable. Used for status, never for auth. */
+export function devinCliSignedIn(deps: DevinCliLoginDeps = {}): boolean {
+  return readDevinCliCredentialFile(deps) !== undefined;
+}
+
+export async function loginDevinCli(
+  ctrl: OAuthController,
+  _opts?: DevinCliLoginOpts,
+  deps: DevinCliLoginDeps = {},
+): Promise<OAuthCredentials> {
+  const file = readDevinCliCredentialFile(deps);
+  if (!file) {
+    // Deliberately names no path contents and no parsed value. A Connect error
+    // can echo a request, and redactSecretString does not recognise a bare JWT
+    // or a devin-session-token, which is why register-user.ts refuses to repeat
+    // error bodies; the same caution applies to anything thrown from here.
+    throw new Error(
+      `No signed-in Devin CLI session found. ${DEVIN_CLI_INSTALL_HINT} Then run \`devin auth login\` and try again.`,
+    );
+  }
+  // The host comes off disk and then receives the key, so it passes the same
+  // allowlist as the RegisterUser host. An unallowlisted value falls back to the
+  // default rather than becoming an exfiltration target.
+  const apiBaseUrl = resolveDevinApiBaseUrl(file.apiServerUrl);
+  ctrl.onProgress?.("Imported the signed-in Devin CLI session.");
+  return {
+    access: file.apiKey,
+    // Cognition issues a durable key and exposes no refresh endpoint. Carrying
+    // the key here rather than "" is the house pattern: an empty refresh makes
+    // detectOAuthWarning report stale_credentials from the moment of login.
+    refresh: file.apiKey,
+    expires: Number.MAX_SAFE_INTEGER,
+    source: "local-cli",
+    apiBaseUrl,
+    ...identityFromApiKey(file.apiKey),
+  };
+}
+
+export async function refreshDevinCliToken(
+  _refreshToken: string,
+  _signal?: AbortSignal,
+  _credential?: OAuthCredentials,
+): Promise<OAuthCredentials> {
+  // The CLI owns this session and Cognition has no refresh endpoint. Extending
+  // the stored expiry would make a revoked key look valid forever; throwing lets
+  // the request path mark the account needsReauth instead.
+  throw new Error("invalid_grant: the Devin CLI owns this session. Run devin auth login again.");
+}

package/src/oauth/devin.ts

@@ -0,0 +1,170 @@
+/**
+ * Devin / Cognition OAuth.
+ *
+ * Login opens the Auth0 browser sign-in flow (windsurf.com/windsurf/signin
+ * with redirect_uri=show-auth-token), then exchanges the pasted Firebase ID
+ * token via Cognition's RegisterUser for a long-lived API key.
+ */
+import { randomUUID } from "node:crypto";
+import type { OAuthController, OAuthCredentials } from "./types";
+import { DEFAULT_REGION, type WindsurfRegion } from "./devin/types";
+import { registerUser } from "./devin/register-user";
+import { DEVIN_DEFAULT_API_SERVER, resolveDevinApiBaseUrl, validateDevinApiBaseUrl } from "./devin/api-base";
+import { getCredential } from "./store";
+
+export { DEVIN_DEFAULT_API_SERVER } from "./devin/api-base";
+
+/**
+ * The api-server host this account must talk to.
+ *
+ * RegisterUser hands EU and FedStart tenants a host of their own and it is kept
+ * on the credential, so the signed-in account decides the destination. The
+ * configured provider baseUrl is the fallback, and the US default is the last
+ * resort; both are re-validated because neither is trusted more than the
+ * network value.
+ */
+export function resolveDevinApiServer(configuredBaseUrl?: string, providerId = "devin"): string {
+  return (
+    // Provider-scoped. `devin` and `devin-cli` share this transport and this token
+    // format but sign in to different accounts, and an EU or FedStart tenant is
+    // recorded on the credential rather than in the registry. Reading a fixed
+    // "devin" slot sent one provider's key to the other's host.
+    validateDevinApiBaseUrl(getCredential(providerId)?.apiBaseUrl) ??
+    validateDevinApiBaseUrl(configuredBaseUrl) ??
+    DEVIN_DEFAULT_API_SERVER
+  );
+}
+
+function decodeJwtPayload(token: string): Record<string, unknown> | undefined {
+  const parts = token.split(".");
+  const payload = parts[1];
+  if (parts.length < 2 || !payload) return undefined;
+  try {
+    return JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as Record<string, unknown>;
+  } catch {
+    return undefined;
+  }
+}
+
+export function identityFromApiKey(apiKey: string): { accountId?: string; email?: string } {
+  const jwtPart = apiKey.includes("$") ? apiKey.slice(apiKey.indexOf("$") + 1) : apiKey;
+  const payload = decodeJwtPayload(jwtPart);
+  const email = typeof payload?.email === "string" && payload.email.length > 0 ? payload.email : undefined;
+  const sub = typeof payload?.sub === "string" && payload.sub.length > 0 ? payload.sub : undefined;
+  const authUid = typeof payload?.auth_uid === "string" && payload.auth_uid.length > 0 ? payload.auth_uid : undefined;
+  return { ...(email ? { email } : {}), ...(sub || authUid ? { accountId: sub ?? authUid } : {}) };
+}
+
+function credentialsFromApiKey(
+  apiKey: string,
+  apiBaseUrl: string,
+  source: OAuthCredentials["source"] = "oauth",
+): OAuthCredentials {
+  const identity = identityFromApiKey(apiKey);
+  return {
+    access: apiKey,
+    // Cognition issues a durable key and exposes no refresh endpoint. Carrying
+    // the key here rather than "" is the house pattern for durable-key
+    // providers: an empty refresh makes detectOAuthWarning report
+    // stale_credentials for every Devin account from the moment it logs in.
+    refresh: apiKey,
+    // No expiry to model. A synthetic one-year deadline only produces a
+    // refresh attempt against an endpoint that does not exist.
+    expires: Number.MAX_SAFE_INTEGER,
+    source,
+    apiBaseUrl,
+    ...identity,
+  };
+}
+
+function buildSignInUrl(region: WindsurfRegion): string {
+  const params = new URLSearchParams({
+    response_type: "token",
+    client_id: region.oauthClientId,
+    redirect_uri: "show-auth-token",
+    state: randomUUID(),
+    prompt: "login",
+  });
+  return region.website + "/windsurf/signin?" + params.toString();
+}
+
+/**
+ * Shape of the value the sign-in page hands back.
+ *
+ * It is not always a JWT. A live free-tier sign-in against
+ * windsurf.com/windsurf/signin returns a 47-character one-time token of the
+ * form `ott$<base64url>`, and RegisterUser accepts it; an earlier JWT-only
+ * check here would have rejected every real login. So this is deliberately a
+ * shape check for "one opaque credential-looking word" rather than a format
+ * check: the point is to tell a token from a pasted URL or a sentence, not to
+ * second-guess what the vendor mints.
+ */
+const TOKEN_SHAPE = /^[A-Za-z0-9._$~+/=-]{20,4096}$/;
+
+const TOKEN_PARAM_NAMES = ["firebase_id_token", "access_token", "id_token", "token"] as const;
+
+/**
+ * Turn whatever the user pasted into the Firebase ID token RegisterUser expects.
+ *
+ * The sign-in page shows a bare token, but a user who copies the address bar
+ * instead hands us a callback URL whose fragment carries it. Posting that URL
+ * as `firebase_id_token` produces an opaque server-side rejection, so pull the
+ * token out and refuse a paste that has none rather than sending something that
+ * cannot work.
+ */
+export function parseDevinAuthPaste(raw: string): string {
+  const trimmed = raw.trim();
+  if (!trimmed) throw new Error("No auth token pasted; cannot complete Devin sign-in.");
+  if (/^https?:\/\//i.test(trimmed)) {
+    let url: URL;
+    try {
+      url = new URL(trimmed);
+    } catch {
+      throw new Error("That paste is not a usable Devin auth token or sign-in URL.");
+    }
+    const hash = url.hash.startsWith("#") ? url.hash.slice(1) : url.hash;
+    for (const params of [new URLSearchParams(hash), url.searchParams]) {
+      for (const name of TOKEN_PARAM_NAMES) {
+        const value = params.get(name)?.trim();
+        if (value && TOKEN_SHAPE.test(value)) return value;
+      }
+    }
+    throw new Error("That sign-in URL carries no auth token. Paste the token shown on the Windsurf page instead.");
+  }
+  if (TOKEN_SHAPE.test(trimmed)) return trimmed;
+  throw new Error("That paste is not a Devin auth token. Copy the token shown on the Windsurf sign-in page.");
+}
+
+async function loginDevinBrowser(ctrl: OAuthController, region: WindsurfRegion): Promise<OAuthCredentials> {
+  const url = buildSignInUrl(region);
+  ctrl.onAuth?.({
+    url,
+    instructions: "Sign in with your Cognition/Devin account, then paste the on-screen auth token here.",
+  });
+  ctrl.onProgress?.("Waiting for the pasted auth token...");
+  const pasted = (await ctrl.onManualCodeInput?.())?.trim();
+  if (!pasted) throw new Error("No auth token pasted; cannot complete Devin sign-in.");
+  const firebaseIdToken = parseDevinAuthPaste(pasted);
+  const result = await registerUser(firebaseIdToken, region, ctrl.signal);
+  const credentials = credentialsFromApiKey(result.apiKey, resolveDevinApiBaseUrl(result.apiServerUrl), "oauth");
+  // The display name is not an identity. Use it only when the key carried no
+  // email, otherwise reauth compares a label against an address and mismatches.
+  if (!credentials.email && result.name) credentials.email = result.name;
+  return credentials;
+}
+
+export async function loginDevin(ctrl: OAuthController): Promise<OAuthCredentials> {
+  return loginDevinBrowser(ctrl, DEFAULT_REGION);
+}
+
+export async function refreshDevinToken(
+  _refreshToken: string,
+  _signal?: AbortSignal,
+  _credential?: OAuthCredentials,
+): Promise<OAuthCredentials> {
+  // Cognition has no refresh endpoint. Extending the stored expiry here is what
+  // the carried implementation did, and it makes a revoked key look valid
+  // forever. Throwing lets the request path mark the account needsReauth the
+  // first time a forced refresh happens.
+  throw new Error("invalid_grant: Devin API keys do not refresh. Run ocx login devin again.");
+}

package/src/oauth/generic-account-failover.ts

@@ -16,7 +16,21 @@
  */
 import { getAccountSet } from "./store";
 import { getValidAccessSnapshotForAccount, type OAuthAccessSnapshot } from "./index";
-import { exhaustedCooldownMs, hasHeadroomEvidence, isAccountQuotaExhausted, rankAccountsByHeadroom } from "./account-quota-rank";
+import {
+  accountHeadroomPercent,
+  exhaustedCooldownMs,
+  hasHeadroomEvidence,
+  isAccountQuotaExhausted,
+  rankAccountsByHeadroom,
+} from "./account-quota-rank";
+import {
+  genericPoolKey,
+  normalizeAccountPoolStickyLimit,
+  notePoolRotationSuccess,
+  peekRoundRobinAccount,
+  pickRoundRobinAccount,
+  seedPoolRotationAccount,
+} from "./pool-kernel";
 import { parseRetryAfterMs } from "../combos/failover";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 import type { OcxConfig, OcxProviderConfig } from "../types";
@@ -169,6 +183,113 @@ export function eligibleFailoverAccounts(providerName: string, now = Date.now())
     .map(account => account.id);
 }
 
+/** Generic pool strategies the kernel can actually run. `quota` IS the pre-kernel path. */
+type ActiveGenericStrategy = "round-robin" | "fill-first";
+
+/** Matches the Codex and Anthropic pools; the DTO still reports `null` for "not stored". */
+const DEFAULT_GENERIC_AUTO_SWITCH_THRESHOLD = 80;
+
+/**
+ * The strategy this provider's pool actually runs, or null for today's behaviour.
+ *
+ * Three different inputs answer null and they all mean the same thing to a caller: the flag is
+ * off, no strategy is stored, or the stored strategy is `quota` — which is precisely what the
+ * unflagged code already does. Collapsing them here is what keeps every call site a two-way
+ * branch instead of a four-way one.
+ */
+function activeGenericStrategy(config: OcxConfig, providerName: string): ActiveGenericStrategy | null {
+  if (config.pool?.kernel !== true) return null;
+  const raw = config.providers?.[providerName]?.oauthAccountFailover?.strategy;
+  return raw === "round-robin" || raw === "fill-first" ? raw : null;
+}
+
+function genericStickyLimit(config: OcxConfig, providerName: string): number {
+  return normalizeAccountPoolStickyLimit(config.providers?.[providerName]?.oauthAccountFailover?.stickyLimit);
+}
+
+/**
+ * The FULL roster in a stable order, not the eligible subset.
+ *
+ * Two load-bearing reasons. The store holds accounts in LOGIN order, so two operators who added
+ * the same accounts in a different sequence would otherwise rotate differently; sorting makes
+ * the ring a property of the accounts rather than of the history. And walking the eligible
+ * subset instead of the full roster changes the wrap order whenever an ineligible id sits
+ * between two eligible ones — the bug the Codex and Anthropic copies carry a `stableAll`
+ * argument to avoid.
+ */
+function stableGenericRoster(providerName: string): string[] {
+  const set = getAccountSet(providerName);
+  if (!set) return [];
+  return set.accounts.map(account => account.id).sort((left, right) => left.localeCompare(right));
+}
+
+/**
+ * Has this account spent enough of its allowance for fill-first to move on?
+ *
+ * An unmeasured account reads as UNDER the threshold, matching the Codex pool: a threshold is a
+ * statement about observed usage, and treating "no observation" as "spent" would evacuate every
+ * quota-less provider off its active account on the very first request.
+ */
+function isOverAutoSwitchThreshold(providerName: string, accountId: string, threshold: number): boolean {
+  const headroom = accountHeadroomPercent(providerName, accountId);
+  if (headroom === null) return false;
+  return 100 - headroom >= threshold;
+}
+
+/**
+ * Fill-first: stay on the active account until it crosses its threshold, then take the next
+ * eligible account in the stable ring. Null means "keep the active account".
+ */
+function pickFillFirstGenericAccount(
+  config: OcxConfig,
+  providerName: string,
+  activeId: string | undefined,
+  now: number,
+): string | null {
+  const stableAll = stableGenericRoster(providerName);
+  if (stableAll.length < 2) return null;
+  const eligible = new Set(eligibleFailoverAccounts(providerName, now));
+  const stored = config.providers?.[providerName]?.oauthAccountFailover?.autoSwitchThreshold;
+  const threshold = typeof stored === "number" && Number.isInteger(stored) && stored >= 0 && stored <= 100
+    ? stored
+    : DEFAULT_GENERIC_AUTO_SWITCH_THRESHOLD;
+  if (activeId && eligible.has(activeId) && !isOverAutoSwitchThreshold(providerName, activeId, threshold)) {
+    return null;
+  }
+  const start = activeId ? stableAll.indexOf(activeId) : -1;
+  const ring = start >= 0 ? [...stableAll.slice(start + 1), ...stableAll.slice(0, start)] : stableAll;
+  for (const id of ring) {
+    if (id !== activeId && eligible.has(id)) return id;
+  }
+  return null;
+}
+
+/**
+ * Advance the round-robin cursor once a dispatch has actually been admitted on this account.
+ *
+ * The early return is the whole safety story for the core path: this is reached on EVERY
+ * generic first dispatch, including quota pools and the fallback after a preferred account was
+ * dropped, so anything but round-robin must leave the cursor untouched.
+ *
+ * The live pick belongs here rather than in the proposal, and that is not stylistic.
+ * `peekRoundRobinAccount` never creates the pool state and `notePoolRotationSuccess` returns
+ * immediately when there is none, so a peek-only path would leave the ring with nothing to
+ * advance and round-robin would propose the same account forever. This is the same shape
+ * `commitAnthropicSelectionRouting` already commits with.
+ */
+export function noteGenericPoolSelection(config: OcxConfig, providerName: string, accountId: string): void {
+  if (activeGenericStrategy(config, providerName) !== "round-robin") return;
+  const poolKey = genericPoolKey(providerName);
+  const limit = genericStickyLimit(config, providerName);
+  const picked = pickRoundRobinAccount(poolKey, eligibleFailoverAccounts(providerName), limit);
+  // The resolver may have admitted a different account than the ring proposed: a removal, a
+  // reauth verdict or a manual selection can land during credential resolution. Realign the
+  // cursor onto what actually served rather than leaving it on a road not taken.
+  if (picked !== accountId) seedPoolRotationAccount(poolKey, accountId);
+  notePoolRotationSuccess(poolKey, accountId, limit);
+}
+
+
 /**
  * Cool the account that actually 429'd and name the next eligible one, or null.
  *
@@ -212,6 +333,30 @@ export function rotateGenericOAuthAccountOn429(
   const ring = start >= 0 ? [...order.slice(start + 1), ...order.slice(0, start)] : order;
   const candidates = ring.filter(id => id !== failedAccountId && eligible.includes(id));
   if (candidates.length === 0) return null;
+  // The 429 path branches too. Leaving it on the quota ranking would make a configured
+  // strategy inert in practice the moment anything actually failed, which is the case the
+  // operator chose the strategy for.
+  const strategy = activeGenericStrategy(config, providerName);
+  if (strategy === "round-robin") {
+    // PICK here, not peek: the failure already happened and this answer is the one being used,
+    // so the ring genuinely advances.
+    return pickRoundRobinAccount(
+      genericPoolKey(providerName),
+      candidates,
+      genericStickyLimit(config, providerName),
+    );
+  }
+  if (strategy === "fill-first") {
+    // Not "keep the active account": the one that just 429'd is cooled, so fill-first takes
+    // the next eligible account in the stable ring rather than its usual hold.
+    const stableAll = stableGenericRoster(providerName);
+    const from = stableAll.indexOf(failedAccountId);
+    const walk = from >= 0 ? [...stableAll.slice(from + 1), ...stableAll.slice(0, from)] : stableAll;
+    for (const id of walk) {
+      if (id !== failedAccountId && candidates.includes(id)) return id;
+    }
+    return null;
+  }
   // With no quota evidence this returns the ring untouched, so providers without
   // per-account quota keep exactly the traversal they have today.
   return rankAccountsByHeadroom(providerName, candidates)[0] ?? null;
@@ -259,6 +404,29 @@ export function preferredInitialAccount(
   const order = selected.accounts.filter(account => account.needsReauth !== true).map(account => account.id);
   if (order.length < 2) return null;
 
+  // A configured strategy answers this question itself. Both guards below exist to protect the
+  // QUOTA answer, and both are fatal to the other two: hasHeadroomEvidence refuses every
+  // provider with no quota data, which is exactly where round-robin is the point, and the
+  // healthy-active return fires before autoSwitchThreshold can ever be read, so fill-first
+  // would never reach its own test. Cooldowns and reauth are still honoured inside each pick.
+  const strategy = activeGenericStrategy(config, providerName);
+  if (strategy === "round-robin") {
+    const eligibleNow = eligibleFailoverAccounts(providerName, now);
+    if (eligibleNow.length === 0) return null;
+    // PEEK, not pick: this proposal is discardable, and advancing the ring for an account the
+    // resolver then rejects would skip a turn for nothing. noteGenericPoolSelection commits.
+    const picked = peekRoundRobinAccount(
+      genericPoolKey(providerName),
+      eligibleNow,
+      genericStickyLimit(config, providerName),
+    );
+    return picked && picked !== active ? picked : null;
+  }
+  if (strategy === "fill-first") {
+    const picked = pickFillFirstGenericAccount(config, providerName, active, now);
+    return picked && picked !== active ? picked : null;
+  }
+
   const activeRow = selected.accounts.find(account => account.id === active);
   if (activeRow && activeRow.needsReauth !== true
     && !isCooled(providerName, activeRow.id, now)

package/src/oauth/index.ts

@@ -38,6 +38,8 @@ import { loginNous, NousTokenError, refreshNousToken, clearNousRefreshIntent, Re
 import { loginChatGPT, refreshChatGPTToken, type ChatGPTLoginFlow } from "./chatgpt";
 import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
 import { loginCursor, refreshCursorToken } from "./cursor";
+import { loginDevin, refreshDevinToken } from "./devin";
+import { loginDevinCli, refreshDevinCliToken } from "./devin-cli";
 import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUrl } from "./github-copilot";
 import { loginCommandCode, refreshCommandCodeToken } from "./command-code";
 import { loginMetaMuse, refreshMetaMuseToken } from "./meta-muse";
@@ -308,6 +310,23 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     providerConfig: oauthConfig("cursor"),
     defaultModel: oauthDefaultModel("cursor"),
   },
+  devin: {
+    login: (ctrl) => loginDevin(ctrl),
+    refresh: refreshDevinToken,
+    providerConfig: oauthConfig("devin"),
+    defaultModel: oauthDefaultModel("devin"),
+    defaultRefreshPolicy: "disabled",
+  },
+  "devin-cli": {
+    // Import-first, the kiro shape: adopt the credential the installed CLI
+    // already holds instead of starting a browser flow it has already completed.
+    login: (ctrl, opts) => loginDevinCli(ctrl, opts),
+    refresh: refreshDevinCliToken,
+    providerConfig: oauthConfig("devin-cli"),
+    defaultModel: oauthDefaultModel("devin-cli"),
+    // The CLI owns the session and Cognition exposes no refresh endpoint.
+    defaultRefreshPolicy: "disabled",
+  },
   "github-copilot": {
     login: (ctrl) => loginGithubCopilot(ctrl),
     refresh: (rt, signal) => refreshGithubCopilotToken(rt, signal),
@@ -320,7 +339,7 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     login: (ctrl, opts) => loginChatGPT(ctrl, { forceLogin: opts?.forceLogin, flow: opts?.flow }),
     refresh: (rt) => refreshChatGPTToken(rt),
     providerConfig: { adapter: "openai-responses", baseUrl: "https://chatgpt.com/backend-api/codex", authMode: "forward" as const },
-    defaultModel: "gpt-5.4",
+    defaultModel: "gpt-5.6-luna",
   },
 };
 

package/src/oauth/login-cli.ts

@@ -65,15 +65,29 @@ export function warnIfLiveReloadSkipped(result: LocalProviderReloadResult | null
   );
 }
 
+/**
+ * The provider wall is the first thing an unfamiliar user sees, so it names the Codex
+ * route before the ~90 provider ids. 'codex' is not in either list on purpose: it is
+ * routed to the account-pool login in dispatch.ts, and 'chatgpt' stays off the public
+ * OAuth surface (isPublicOAuthProvider) because the pool owns that credential.
+ *
+ * It names 'openai-apikey' for the same reason it exists at all: 'openai' now routes to
+ * the pool, so someone who typed it looking for a platform key no longer sees the list
+ * that used to be their only pointer to it.
+ */
+export function loginUsageMessage(): string {
+  return `Usage: ocx login <provider>\n`
+    + `  Codex / ChatGPT: ocx login codex   (account pool, needs a running proxy; 'chatgpt' and\n`
+    + `                   'openai' are the same route. An OpenAI platform key is 'openai-apikey'.)\n`
+    + `  OAuth login:   ${listOAuthProviders().join(", ")}\n`
+    + `  API-key login: ${Object.keys(KEY_LOGIN_PROVIDERS).join(", ")}`;
+}
+
 export async function handleLogin(provider?: string): Promise<void> {
   const name = (provider ?? "").trim().toLowerCase();
   if (isPublicOAuthProvider(name)) return handleOAuthLogin(name);
   if (isKeyLoginProvider(name)) return handleKeyLogin(name);
-  console.error(
-    `Usage: ocx login <provider>\n` +
-      `  OAuth login:   ${listOAuthProviders().join(", ")}\n` +
-      `  API-key login: ${Object.keys(KEY_LOGIN_PROVIDERS).join(", ")}`,
-  );
+  console.error(loginUsageMessage());
   process.exit(1);
 }