@bitkyc08/opencodex 2.52.0 → 2.53.0-preview.20260913

package/src/images/loop.ts

@@ -24,7 +24,9 @@ import { readBoundedResponseBody } from "../lib/bounded-body";
 import { applyUpstreamRecoveryInit, fetchWithResetRetry, prepareSameTarget429Wait } from "../lib/upstream-retry";
 import { rateLimitRetryDelayMs } from "../providers/key-failover";
 import {
+  createTranslatorBudget,
   isTranslatorBudgetExceededError,
+  TRANSLATOR_MAX_CALL_ARGUMENT_BYTES,
   TRANSLATOR_MAX_TURN_BYTES,
   TranslatorBudgetExceededError,
 } from "../lib/translator-budget";
@@ -101,6 +103,57 @@ interface ImageCall {
   providerMetadata?: OcxProviderOpaqueToolCallMetadata;
 }
 
+/** Independent retention owner: adapter leases and final SSE buffers have separate lifetimes. */
+function createIterationEventBudget() {
+  const budget = createTranslatorBudget();
+  let firstEvent = true;
+  let argumentBytes: number | undefined;
+  let trailingHighSurrogate = false;
+  return {
+    retain(event: AdapterEvent, coalescedIntoTail = false): void {
+      // Heartbeats are never retained or passed to scanEventsForImageCall.
+      if (event.type === "heartbeat") return;
+      if (event.type === "tool_call_start") {
+        argumentBytes = 0;
+        trailingHighSurrogate = false;
+      } else if (event.type === "tool_call_delta" && argumentBytes !== undefined) {
+        const chunk = event.arguments;
+        argumentBytes += Buffer.byteLength(chunk);
+        // A surrogate pair may straddle adapter deltas; count the concatenated UTF-8 string.
+        if (trailingHighSurrogate && /^[\uDC00-\uDFFF]/.test(chunk)) argumentBytes -= 2;
+        if (chunk.length > 0) trailingHighSurrogate = /[\uD800-\uDBFF]$/.test(chunk);
+        if (argumentBytes > TRANSLATOR_MAX_CALL_ARGUMENT_BYTES) {
+          throw new TranslatorBudgetExceededError("tool_args", TRANSLATOR_MAX_CALL_ARGUMENT_BYTES);
+        }
+      } else {
+        argumentBytes = undefined;
+        trailingHighSurrogate = false;
+      }
+      // A delta the queue merged into its buffered tail leaves one object behind, not two,
+      // so it costs the appended payload rather than another envelope. Charging the whole
+      // event here would bill over 32 MiB for the ~1 MiB that a million one-character text
+      // deltas actually retain, and abort a turn far below the documented limit.
+      const appended = coalescedIntoTail
+        ? event.type === "text_delta" ? event.text : event.type === "thinking_delta" ? event.thinking : undefined
+        : undefined;
+      if (appended !== undefined) {
+        // JSON escaping is per character, so the tail grows by the quoted form minus its
+        // quotes. A surrogate pair split across two deltas is the one over-count, by eight
+        // bytes, which bounds memory conservatively and never under-charges.
+        budget.chargeRetained(Buffer.byteLength(JSON.stringify(appended)) - 2, {
+          kind: "retained_collectors",
+        });
+        return;
+      }
+      budget.chargeRetained(Buffer.byteLength(JSON.stringify(event)) + (firstEvent ? 2 : 1), {
+        kind: "retained_collectors",
+      });
+      firstEvent = false;
+    },
+    dispose: () => budget.dispose(),
+  };
+}
+
 /**
  * Split an iteration's adapter events into (a) the image-generation tool calls to intercept and
  * (b) the events to pass through to Codex. An image tool-call's own start/delta/end events are
@@ -370,6 +423,8 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
   interface IterationResponse {
     response: Response;
     responseAdapter: ProviderAdapter;
+    /** runTurn events are already bounded; consume them without replaying or charging twice. */
+    collectedEvents?: AdapterEvent[];
   }
   type IterationSplit = ReturnType<typeof scanEventsForImageCall>;
 
@@ -397,29 +452,31 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
 
     // runTurn adapters (Cursor) own all upstream communication via an emit callback. They don't
     // expose buildRequest/fetchResponse/parseStream to the bridge, so collect their events through
-    // an AdapterEventQueue and wrap them in a pseudo-response whose parseStream replays them.
+    // an AdapterEventQueue and pass the bounded collection directly to the common scanner.
     if (adapter.runTurn) {
       await deps.waitForRequestSlot?.(signal);
       const queue = createAdapterEventQueue({
         onBacklogExceeded: () => internalAbort.abort("runTurn backlog exceeded"),
       });
-      // Attempt telemetry must fire at dispatch time (parity with fetchOnce), not after collect.
-      deps.onAttemptSend?.();
-      void adapter
-        .runTurn(
-          iterParsed,
-          {
-            headers: deps.forwardHeaders ? new Headers(deps.forwardHeaders) : new Headers(),
-            abortSignal: signal,
-            translatorBudget,
-          },
-          queue.push,
-        )
-        .then(() => queue.close())
-        .catch(err => {
-          queue.push({ type: "error", message: err instanceof Error ? err.message : String(err) });
-          queue.close();
-        });
+      const iterationBudget = createIterationEventBudget();
+      let accepting = true;
+      let collectionError: unknown;
+      const closeOnAbort = (): void => { accepting = false; queue.close(); };
+      signal.addEventListener("abort", closeOnAbort, { once: true });
+      const emit = (event: AdapterEvent): void => {
+        if (!accepting || signal.aborted) return;
+        try {
+          // Check at emission, before even a synchronous producer can fill the queue. push
+          // reports whether it merged this delta into the buffered tail, which is what the
+          // iteration actually retains once the consumer drains it.
+          iterationBudget.retain(event, queue.push(event));
+        } catch (error) {
+          collectionError = error;
+          closeOnAbort();
+          internalAbort.abort(error);
+          throw error;
+        }
+      };
 
       // Bound collect with a real *idle* deadline that resets on each emitted event.
       // A fixed wall-clock race would abort legitimate long Cursor turns that keep
@@ -439,14 +496,34 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       });
       const events: AdapterEvent[] = [];
       try {
+        // Attempt telemetry must fire at dispatch time, not after collection.
+        deps.onAttemptSend?.();
+        void adapter.runTurn(iterParsed, {
+          headers: deps.forwardHeaders ? new Headers(deps.forwardHeaders) : new Headers(),
+          abortSignal: signal,
+          translatorBudget,
+        }, emit).then(closeOnAbort).catch(err => {
+          if (accepting) {
+            collectionError = err;
+            if (isTranslatorBudgetExceededError(err)) internalAbort.abort(err);
+          }
+          closeOnAbort();
+        });
         idle.reset();
         for await (const event of queue.stream()) {
           if (timedOut) break;
           idle.reset();
-          events.push(event);
+          if (event.type !== "heartbeat") events.push(event);
         }
       } finally {
+        accepting = false;
         idle.cancel();
+        signal.removeEventListener("abort", closeOnAbort);
+        iterationBudget.dispose();
+      }
+      if (collectionError) {
+        if (isTranslatorBudgetExceededError(collectionError)) throw collectionError;
+        throw new LoopError(502, collectionError instanceof Error ? collectionError.message : String(collectionError));
       }
       if (timedOut) {
         throw new LoopError(504, `runTurn inactivity timeout after ${stallTimeoutMs}ms during image-bridge`);
@@ -466,14 +543,9 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
         }
         throw new LoopError(502, errorEvent.message);
       }
+      if (signal.aborted) throw new LoopError(499, "client closed request during image-bridge");
 
-      const wrappedAdapter: ProviderAdapter = {
-        ...adapter,
-        async *parseStream() {
-          for (const e of events) yield e;
-        },
-      };
-      return { response: new Response(new Uint8Array(0), { status: 200 }), responseAdapter: wrappedAdapter };
+      return { response: new Response(new Uint8Array(0), { status: 200 }), responseAdapter: adapter, collectedEvents: events };
     }
 
     let headerDeadline = clearableDeadline(connectTimeoutMs, signal);
@@ -643,23 +715,34 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
   // Consume and validate one successful response body. Only invisible heartbeat events escape while
   // semantic output remains buffered for safe scanning.
   const consumeIterationEvents = async function* (prepared: IterationResponse): AsyncGenerator<AdapterEvent, IterationSplit> {
-    const events: AdapterEvent[] = [];
+    const events: AdapterEvent[] = prepared.collectedEvents ?? [];
+    const iterationBudget = prepared.collectedEvents ? undefined : createIterationEventBudget();
     try {
-      const parse = prepared.responseAdapter.parseStream.bind(prepared.responseAdapter);
-      for await (const event of parseStreamWithProgress(prepared.response, parse, {
-        signal,
-        inactivityTimeoutMs: stallTimeoutMs,
-        translatorBudget,
-      })) {
-        if (event.type === "heartbeat") yield event;
-        else events.push(event);
+      if (iterationBudget) {
+        const parse = prepared.responseAdapter.parseStream.bind(prepared.responseAdapter);
+        for await (const event of parseStreamWithProgress(prepared.response, parse, {
+          signal,
+          inactivityTimeoutMs: stallTimeoutMs,
+          translatorBudget,
+        })) {
+          if (event.type === "heartbeat") yield event;
+          else {
+            iterationBudget.retain(event);
+            events.push(event);
+          }
+        }
       }
     } catch (error) {
-      if (isTranslatorBudgetExceededError(error)) throw error;
+      if (isTranslatorBudgetExceededError(error)) {
+        internalAbort.abort(error);
+        throw error;
+      }
       if (signal.aborted) throw new LoopError(499, "client closed request during image-bridge");
       if (error instanceof RoutedModelInactivityError) throw new LoopError(504, error.message);
       if (error instanceof WebSearchStreamProtocolError) throw new LoopError(502, error.message);
       throw new LoopError(502, `Provider stream error: ${error instanceof Error ? error.message : String(error)}`);
+    } finally {
+      iterationBudget?.dispose();
     }
 
     const terminalIndexes = events.flatMap((event, index) =>

package/src/lib/admission.ts

@@ -58,20 +58,26 @@ export function createAdmissionGate(name: string, limit: number): {
 }
 
 export function retainedUtf8Bytes(value: string): number {
-  return new TextEncoder().encode(value).byteLength;
+  // Keep TextEncoder's runtime coercion for legacy callers outside the string-typed contract.
+  // Template coercion rejects Symbols; String(value) would silently accept them.
+  return Buffer.byteLength(typeof value === "string" ? value : value === undefined ? "" : `${value}`, "utf8");
 }
 
 function utf8Prefix(value: string, maxBytes: number): string {
   if (maxBytes <= 0) return "";
   let bytes = 0;
-  let result = "";
-  for (const character of value) {
-    const size = retainedUtf8Bytes(character);
+  let end = 0;
+  while (end < value.length) {
+    const code = value.charCodeAt(end);
+    const next = value.charCodeAt(end + 1);
+    const pair = code >= 0xd800 && code <= 0xdbff && next >= 0xdc00 && next <= 0xdfff;
+    // An unpaired surrogate encodes as a three-byte replacement, like TextEncoder.
+    const size = code <= 0x7f ? 1 : code <= 0x7ff ? 2 : pair ? 4 : 3;
     if (bytes + size > maxBytes) break;
-    result += character;
     bytes += size;
+    end += pair ? 2 : 1;
   }
-  return result;
+  return value.slice(0, end);
 }
 
 export function truncateRetainedUtf8(value: string, maxBytes: number): string {

package/src/lib/redact.ts

@@ -252,6 +252,13 @@ const SECRET_VALUE_PATTERNS: Array<[RegExp, string]> = [
   [/((?:"(?:api[_-]?key|access[_-]?token|refresh[_-]?token|id[_-]?token|client[_-]?secret|refreshToken|accessToken|clientSecret|apiKey)"\s*:\s*"))([^"]+)(")/gi, `$1${REDACTED_SECRET}$3`],
   // Raw JSON "token" field values (Copilot token exchange bodies echo the credential here).
   [/(("token"\s*:\s*"))([^"]+)(")/gi, `$1${REDACTED_SECRET}$4`],
+  // Cognition/Devin session keys, and the bare JWTs several providers hand out.
+  // A Connect EOS trailer can quote the request that carried the key, and the
+  // rules above only fire on a label — `Bearer`, `api_key=`, `"token":` — which
+  // a quoted proto field does not have. `eyJ` is the base64url of `{"`, so the
+  // JWT rule needs a real three-segment shape and does not match ordinary prose.
+  [/\bdevin-session-token\$[A-Za-z0-9._~+/=-]{8,}/g, REDACTED_SECRET],
+  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g, REDACTED_SECRET],
   [/\b(arn:aws:[A-Za-z0-9_-]+:[A-Za-z0-9-]*:\d{12}:[A-Za-z0-9_/:+=,.@-]+)\b/g, REDACTED_SECRET],
 ];
 

package/src/lib/translator-budget.ts

@@ -112,14 +112,15 @@ export function retainTranslatedEvent<T extends object>(
  */
 export function retainTranslatedEventBatch<T extends object>(events: T[], budget: TranslatorBudget): void {
   if (events.length === 0) return;
-  const serialized = events.map(event => JSON.stringify(event));
-  const totalBytes = Buffer.byteLength(`[${serialized.join(",")}]`);
+  // Preserve atomic batch admission without retaining serialized strings or joining a second copy.
+  const eventBytes = events.map(event => Buffer.byteLength(JSON.stringify(event)));
+  const totalBytes = eventBytes.reduce((total, bytes) => total + bytes, events.length + 1);
   budget.chargeRetained(totalBytes, { kind: "retained_collectors" });
   for (let index = 0; index < events.length; index++) {
     const delimiterBytes = index === events.length - 1 ? 2 : 1;
     retainedEventOwnership.set(events[index]!, {
       budget,
-      bytes: Buffer.byteLength(serialized[index]!) + delimiterBytes,
+      bytes: eventBytes[index]! + delimiterBytes,
     });
   }
 }

package/src/lib/windows-atomic-replace.ts

@@ -33,6 +33,7 @@ export type ReplacePublisher =
   | "claude-agents"
   | "lab-automation"
   | "lab-ledger"
+  | "remote-workspace"
   | "storage-cleanup"
   | "tray";
 

package/src/lib/windows-elevation.ts

@@ -397,7 +397,7 @@ export function formatWindowsSchtasksError(error: unknown, args: string[]): stri
   const guidance = [
     "Windows access denied while running Task Scheduler.",
     `Command: schtasks ${argsText}`,
-    "Approve the Windows UAC prompt to install the background service, or run `ocx service install` from an elevated PowerShell window.",
+    "The OpenCodex task definition is scoped to the installing account and normally registers without elevation, so this denial is not fixed by approving a UAC prompt. Check `ocx service status`: if an existing `opencodex-proxy` task belongs to a different account, remove it from that account and retry `ocx service install`.",
   ].join(" ");
   if (operation === "create" && ownedCreateAccessDenied) {
     return `${guidance}\n${WINDOWS_SCHTASKS_CREATE_ACCESS_DENIED_MARKER}`;

package/src/oauth/chatgpt-device.ts

@@ -23,6 +23,19 @@ export const DEVICE_VERIFICATION_URL = "https://auth.openai.com/codex/device";
 
 /** The grant's own lifetime. Polling past this only produces a worse error message. */
 const DEVICE_FLOW_TTL_MS = 15 * 60 * 1000;
+/**
+ * Per-fetch deadline for every device-flow HTTP call (#3898). Until this
+ * existed the only bounds were the 15-minute grant TTL and the caller's
+ * abort, so one stuck TCP connection could hold the login slot for the whole
+ * grant. A FRESH timeout per fetch attempt is required — a single timeout
+ * shared across the poll loop would kill the 15-minute grant.
+ */
+export const DEVICE_FETCH_TIMEOUT_MS = 30_000;
+
+function deviceFetchSignal(signal?: AbortSignal): AbortSignal {
+  const timeout = AbortSignal.timeout(DEVICE_FETCH_TIMEOUT_MS);
+  return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
 const DEFAULT_POLL_INTERVAL_MS = 5_000;
 const MIN_POLL_INTERVAL_MS = 1_000;
 /**
@@ -86,7 +99,7 @@ async function requestUserCode(signal?: AbortSignal): Promise<DeviceUserCode> {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ client_id: CHATGPT_CLIENT_ID }),
-    signal,
+    signal: deviceFetchSignal(signal),
   });
   if (!response.ok) throw deviceError("request", response.status);
   const payload = (await response.json()) as Record<string, unknown>;
@@ -123,7 +136,7 @@ async function pollForGrant(
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ device_auth_id: device.deviceAuthId, user_code: device.userCode }),
-      signal,
+      signal: deviceFetchSignal(signal),
     });
     if (response.status === 403 || response.status === 404) {
       // Cap the wait at the time actually left. Sleeping a full interval past
@@ -149,7 +162,7 @@ async function pollForGrant(
   throw new Error("ChatGPT device authorization expired");
 }
 
-async function exchangeGrant(grant: DeviceGrant, signal?: AbortSignal): Promise<OAuthCredentials> {
+async function exchangeGrantRaw(grant: DeviceGrant, signal?: AbortSignal): Promise<Record<string, unknown>> {
   const response = await fetch(CHATGPT_TOKEN_URL, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
@@ -160,10 +173,54 @@ async function exchangeGrant(grant: DeviceGrant, signal?: AbortSignal): Promise<
       code_verifier: grant.codeVerifier,
       redirect_uri: DEVICE_REDIRECT_URI,
     }).toString(),
-    signal,
+    signal: deviceFetchSignal(signal),
   });
   if (!response.ok) throw deviceError("token exchange", response.status);
-  return credsFromToken((await response.json()) as Record<string, unknown>);
+  return (await response.json()) as Record<string, unknown>;
+}
+
+async function exchangeGrant(grant: DeviceGrant, signal?: AbortSignal): Promise<OAuthCredentials> {
+  return credsFromToken(await exchangeGrantRaw(grant, signal));
+}
+
+/**
+ * The native-main reauth result (#3898): the projected credential PLUS the
+ * id_token the pool projection deliberately drops. The id_token is the
+ * identity document the native auth.json requires
+ * (native-profile-store.ts), and it never leaves this process — it is
+ * written to the native main slot by the caller, never serialized into a
+ * DTO, log, or error.
+ */
+export interface NativeDeviceLogin {
+  credential: OAuthCredentials;
+  idToken: string;
+}
+
+async function exchangeGrantNative(grant: DeviceGrant, signal?: AbortSignal): Promise<NativeDeviceLogin> {
+  const payload = await exchangeGrantRaw(grant, signal);
+  const credential = credsFromToken(payload);
+  const idToken = nonEmptyString(payload.id_token);
+  if (!idToken) throw new Error("ChatGPT device token response missing id_token");
+  if (!credential.refresh) throw new Error("ChatGPT device token response missing refresh token");
+  if (!credential.accountId) throw new Error("ChatGPT device token response missing account identity");
+  return { credential, idToken };
+}
+
+/**
+ * Device flow for the native __main__ slot. Same grant as the pool flow, but
+ * nothing is persisted here and no OAuth store is touched: the caller
+ * (main-device-reauth service) owns the fenced commit into CODEX_HOME
+ * auth.json.
+ */
+export async function loginChatGPTNativeDevice(ctrl: OAuthController): Promise<NativeDeviceLogin> {
+  const device = await requestUserCode(ctrl.signal);
+  ctrl.onAuth?.({
+    url: DEVICE_VERIFICATION_URL,
+    instructions: `Enter code: ${device.userCode}`,
+    deviceCode: device.userCode,
+  });
+  const grant = await pollForGrant(device, ctrl.signal);
+  return exchangeGrantNative(grant, ctrl.signal);
 }
 
 /**

package/src/oauth/devin/cli-import.ts

@@ -0,0 +1,130 @@
+/**
+ * Devin CLI credential-file import.
+ *
+ * The installed CLI writes `credentials.toml` after `devin auth login`, and the
+ * `windsurf_api_key` in it is an ordinary `devin-session-token$<JWT>` — the same
+ * shape RegisterUser returns for the browser sign-in, and the same one the
+ * cloud-direct client already speaks. Measured against a signed-in CLI: it mints
+ * a user_jwt, opens the full model catalog, and streams chat.
+ *
+ * This module is only the file-reading half of that. The login decision —
+ * adopt the CLI session when present, fall back to the Auth0 browser flow when
+ * the file is absent — lives in `loginDevin` in `../devin.ts`, because the
+ * merged `devin` provider owns both paths (`devin-cli` survives only as a
+ * deprecated alias for unmigrated configs).
+ *
+ * The file also carries `devin_webapp_host` and `devin_api_url`, which belong to
+ * the Devin *session* product (`cog_` keys, agent VMs) rather than to model
+ * inference. Neither is read here.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+
+/** Absolute-path override, for a CLI installed somewhere this resolver does not model. */
+export const DEVIN_CLI_CREDENTIALS_ENV = "OPENCODEX_DEVIN_CLI_CREDENTIALS";
+
+export interface DevinCliLoginDeps {
+  env?: NodeJS.ProcessEnv;
+  platform?: NodeJS.Platform;
+  exists?: (path: string) => boolean;
+  read?: (path: string) => string;
+}
+
+/**
+ * Where the CLI keeps its own credential.
+ *
+ * Measured on a live install: `$XDG_DATA_HOME/devin/credentials.toml`, i.e.
+ * `~/.local/share/devin/...`, which `devin auth status` prints. Note this is the
+ * DATA dir, not the config dir — an earlier draft guessed `~/.config` and was
+ * wrong. The Windows branch mirrors the CLI's own installer.
+ */
+export function devinCliCredentialsPath(
+  env: NodeJS.ProcessEnv = process.env,
+  platform: NodeJS.Platform = process.platform,
+): string {
+  const override = env[DEVIN_CLI_CREDENTIALS_ENV]?.trim();
+  // Absolute only. A relative override would resolve against whatever directory
+  // the proxy happens to be running in, which is not a location a user can mean.
+  if (override && (override.startsWith("/") || /^[A-Za-z]:[\\/]/.test(override))) return override;
+  const paths = platform === "win32" ? win32 : posix;
+  if (platform === "win32") {
+    // `??` treats an empty APPDATA as set, and join("", "devin", …) is a path
+    // relative to whatever directory the proxy was started in — so a file planted
+    // there would import as the operator's own CLI session. An empty or
+    // whitespace-only value is an absent value.
+    const appData = env.APPDATA?.trim() || paths.join(homedir(), "AppData", "Roaming");
+    return paths.join(appData, "devin", "credentials.toml");
+  }
+  const dataHome = env.XDG_DATA_HOME?.trim() || paths.join(homedir(), ".local", "share");
+  return paths.join(dataHome, "devin", "credentials.toml");
+}
+
+export interface DevinCliCredentialFile {
+  apiKey: string;
+  apiServerUrl: string;
+}
+
+/**
+ * Upper bound on the credential file we are willing to parse.
+ *
+ * The measured file is four short lines. Reading an arbitrarily large file into
+ * a string and running two global-ish regexes over it is work we never need to
+ * do, and a file this size is not the CLI's.
+ */
+const DEVIN_CLI_CREDENTIALS_MAX_BYTES = 64 * 1024;
+
+/**
+ * Why the import has no credential, for the caller that owns the response.
+ *
+ * `missing` and `unreadable` used to collapse into the same `undefined`, so a
+ * permission error on an existing file was reported as "not signed in" and sent
+ * the operator to `devin auth login`, which does not fix it. The distinction
+ * matters even more now that `missing` is the browser-fallback branch: only an
+ * absent file may fall through.
+ */
+export type DevinCliCredentialOutcome =
+  | { kind: "ok"; file: DevinCliCredentialFile }
+  | { kind: "missing" }
+  | { kind: "unreadable" }
+  | { kind: "incomplete" };
+
+export function readDevinCliCredentialOutcome(deps: DevinCliLoginDeps = {}): DevinCliCredentialOutcome {
+  const path = devinCliCredentialsPath(deps.env, deps.platform);
+  const exists = deps.exists ?? existsSync;
+  if (!exists(path)) return { kind: "missing" };
+  let raw: string;
+  try {
+    raw = (deps.read ?? ((p: string) => readFileSync(p, "utf8")))(path);
+  } catch {
+    // Nothing from the error is repeated: it carries the path, and an EACCES
+    // message is not worth the risk of echoing anything read off disk.
+    return { kind: "unreadable" };
+  }
+  if (raw.length > DEVIN_CLI_CREDENTIALS_MAX_BYTES) return { kind: "unreadable" };
+  const apiKey = raw.match(/^\s*windsurf_api_key\s*=\s*"([^"]+)"/m)?.[1]?.trim();
+  const apiServerUrl = raw.match(/^\s*api_server_url\s*=\s*"([^"]+)"/m)?.[1]?.trim();
+  if (!apiKey || !apiServerUrl) return { kind: "incomplete" };
+  return { kind: "ok", file: { apiKey, apiServerUrl } };
+}
+
+/**
+ * Read the two keys that matter, and nothing else.
+ *
+ * The measured file is four flat `key = "value"` lines: no tables, no comments,
+ * no single quotes. A line matcher is therefore enough and a TOML dependency is
+ * not, and the quoted form is required rather than optional — an unquoted
+ * matcher would pass its own fixtures and miss the real file.
+ *
+ * Returns undefined rather than throwing so the caller owns the outcome.
+ * Nothing here ever puts the file's contents into a thrown value.
+ */
+export function readDevinCliCredentialFile(deps: DevinCliLoginDeps = {}): DevinCliCredentialFile | undefined {
+  const outcome = readDevinCliCredentialOutcome(deps);
+  return outcome.kind === "ok" ? outcome.file : undefined;
+}
+
+/** True when a signed-in CLI credential is readable. Used for status, never for auth. */
+export function devinCliSignedIn(deps: DevinCliLoginDeps = {}): boolean {
+  return readDevinCliCredentialFile(deps) !== undefined;
+}

package/src/oauth/devin.ts

@@ -1,15 +1,24 @@
 /**
  * Devin / Cognition OAuth.
  *
- * Login opens the Auth0 browser sign-in flow (windsurf.com/windsurf/signin
- * with redirect_uri=show-auth-token), then exchanges the pasted Firebase ID
- * token via Cognition's RegisterUser for a long-lived API key.
+ * Login is import-first: a signed-in Devin CLI has already completed PKCE, so
+ * its credentials.toml session is adopted without opening a browser (the kiro
+ * shape). Only when no CLI credential exists does login fall back to the Auth0
+ * browser sign-in flow (windsurf.com/windsurf/signin with
+ * redirect_uri=show-auth-token), which exchanges the pasted Firebase ID token
+ * via Cognition's RegisterUser for a long-lived API key. The browser path is
+ * kept because it is the only login route for a user without the CLI.
+ *
+ * `devin-cli` used to be a second provider id owning the import half; it is
+ * now a deprecated alias for `devin` (see DEPRECATED_OAUTH_PROVIDER_ALIASES in
+ * ./index), and this module is the single login/refresh owner for both.
  */
 import { randomUUID } from "node:crypto";
 import type { OAuthController, OAuthCredentials } from "./types";
 import { DEFAULT_REGION, type WindsurfRegion } from "./devin/types";
 import { registerUser } from "./devin/register-user";
 import { DEVIN_DEFAULT_API_SERVER, resolveDevinApiBaseUrl, validateDevinApiBaseUrl } from "./devin/api-base";
+import { readDevinCliCredentialOutcome } from "./devin/cli-import";
 import { getCredential } from "./store";
 
 export { DEVIN_DEFAULT_API_SERVER } from "./devin/api-base";
@@ -25,10 +34,13 @@ export { DEVIN_DEFAULT_API_SERVER } from "./devin/api-base";
  */
 export function resolveDevinApiServer(configuredBaseUrl?: string, providerId = "devin"): string {
   return (
-    // Provider-scoped. `devin` and `devin-cli` share this transport and this token
-    // format but sign in to different accounts, and an EU or FedStart tenant is
-    // recorded on the credential rather than in the registry. Reading a fixed
-    // "devin" slot sent one provider's key to the other's host.
+    // Provider-scoped, keyed by the configured provider id verbatim. `devin-cli`
+    // is a deprecated alias for `devin`, but an unmigrated config row still owns
+    // its old credential slot until the startup migration rekeys the row and the
+    // slot together — normalizing the id here would read the wrong slot for that
+    // window. An EU or FedStart tenant is recorded on the credential rather than
+    // in the registry, so a fixed "devin" slot would send the key to the wrong
+    // host either way.
     validateDevinApiBaseUrl(getCredential(providerId)?.apiBaseUrl) ??
     validateDevinApiBaseUrl(configuredBaseUrl) ??
     DEVIN_DEFAULT_API_SERVER
@@ -153,7 +165,50 @@ async function loginDevinBrowser(ctrl: OAuthController, region: WindsurfRegion):
   return credentials;
 }
 
-export async function loginDevin(ctrl: OAuthController): Promise<OAuthCredentials> {
+/**
+ * Import-first login for the merged `devin` provider.
+ *
+ * A signed-in CLI already completed PKCE, so its session is adopted directly
+ * and no browser opens. Only `missing` falls through to the browser flow:
+ * `unreadable` and `incomplete` describe a file that exists but is broken,
+ * and a browser sign-in would not repair it, so they throw rather than
+ * silently routing around the real problem. `forceLogin` skips the import
+ * outright — reauth and add-account must be able to reach a different account
+ * than the CLI's, and the management routes already set it for both.
+ */
+export async function loginDevin(
+  ctrl: OAuthController,
+  opts?: { forceLogin?: boolean },
+): Promise<OAuthCredentials> {
+  if (opts?.forceLogin !== true) {
+    const outcome = readDevinCliCredentialOutcome();
+    // No branch names path contents or parsed values. A Connect error can echo
+    // a request, and redactSecretString does not recognise a bare JWT or a
+    // devin-session-token — the same caution register-user.ts applies to error
+    // bodies applies to anything thrown here.
+    if (outcome.kind === "unreadable") {
+      // The file is there and we could not read it, so `devin auth login` is
+      // the wrong instruction: it would succeed and change nothing.
+      throw new Error(
+        "Found a Devin CLI credential file but could not read it. Check its permissions and size, then try again.",
+      );
+    }
+    if (outcome.kind === "incomplete") {
+      throw new Error(
+        "The Devin CLI credential file is missing its session key or API server URL. Run `devin auth login` again to rewrite it.",
+      );
+    }
+    if (outcome.kind === "ok") {
+      // The host comes off disk and then receives the key, so it passes the
+      // same allowlist as the RegisterUser host. An unallowlisted value falls
+      // back to the default rather than becoming an exfiltration target.
+      const apiBaseUrl = resolveDevinApiBaseUrl(outcome.file.apiServerUrl);
+      ctrl.onProgress?.("Imported the signed-in Devin CLI session.");
+      return credentialsFromApiKey(outcome.file.apiKey, apiBaseUrl, "local-cli");
+    }
+    // "missing": no CLI session to adopt. The browser flow below is the only
+    // login path left for a user without the CLI installed.
+  }
   return loginDevinBrowser(ctrl, DEFAULT_REGION);
 }