@bitkyc08/opencodex 2.52.0 → 2.53.0-preview.20260913

package/src/oauth/meta-muse.ts

@@ -25,6 +25,7 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { sanitizeApiKeyValue } from "../providers/api-keys";
+import { MuseDeviceLoginError, loginMetaMuseDevice } from "./meta-muse-device";
 import type { OAuthController, OAuthCredentials } from "./types";
 
 const MUSE_POINTER_PATH = join(homedir(), ".config", "muse", "auth.json");
@@ -43,6 +44,7 @@ const KEYCHAIN_TIMEOUT_MS = 5_000;
  */
 const CONSENT_WARNING = [
   "Meta scopes the Muse Code credential to the Muse Code CLI.",
+  "A device login authenticates as Meta own Muse Code client, which is a stronger claim than reusing a key your CLI already minted, and that grant has not been exercised against Meta from OpenCodex.",
   "Using it here is UNSUPPORTED: Meta does not authorize subscription coverage outside its own CLI,",
   "how these calls settle is not observable from the API, and you should treat every call as billable.",
   "The key you import or paste is copied into OpenCodex's auth store (~/.opencodex/auth.json, 0600).",
@@ -65,6 +67,16 @@ export interface MuseImportDeps {
   readPointer?: () => Promise<string | null>;
   readKeychain?: (signal?: AbortSignal) => Promise<string | null>;
   fetchImpl?: typeof fetch;
+  /** Injected so login-order tests exercise the order without running a grant. */
+  loginDevice?: (ctrl: OAuthController) => Promise<OAuthCredentials>;
+  /** Forwarded into the device grant so no test can reach the network or a real timer. */
+  sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+  now?: () => number;
+}
+
+export interface MuseLoginOptions {
+  /** `"off"` skips the Keychain import; add-account and reauth pass it. */
+  importLocal?: "fallback" | "off";
 }
 
 async function defaultReadPointer(): Promise<string | null> {
@@ -111,9 +123,6 @@ async function defaultReadKeychain(signal?: AbortSignal): Promise<string | null>
   }
 }
 
-const INSTALL_HINT =
-  "Install it from https://dev.meta.ai/install.sh, run `muse login`, then retry.";
-
 /**
  * Where a user without the CLI gets a key by hand.
  *
@@ -165,40 +174,62 @@ function normalizedEmail(value: unknown): string | undefined {
 export async function loginMetaMuse(
   ctrl: OAuthController = {},
   deps: MuseImportDeps = {},
+  options: MuseLoginOptions = {},
 ): Promise<OAuthCredentials> {
   // Before ANY read: the CLI has no other warning surface.
   ctrl.onProgress?.(CONSENT_WARNING);
 
   const platform = deps.platform ?? process.platform;
-  // Off darwin there is no store this importer can read: Meta ships no native Windows
-  // CLI, and the Linux credential shape has never been measured. That is a limitation
-  // of the IMPORT, not of the platform ??the same key is visible in Meta's console ??
-  // so these hosts get a paste field instead of a dead end. The pasted key then goes
-  // through the identical grammar check and live validation as an imported one.
-  if (platform !== "darwin") {
-    // The two platforms are unavailable for DIFFERENT reasons, and saying so matters:
-    // Meta ships no Windows build at all, while the Linux CLI exists and only its
-    // credential storage is unmeasured. Collapsing them into "no CLI here" would tell
-    // a Linux user something false about their own machine.
-    const reason = platform === "win32"
-      ? "Meta ships no native Windows Muse Code CLI, so there is no credential to import."
-      : "The Muse Code CLI runs here, but where it stores its credential has not been measured, "
-        + "so importing one is refused rather than guessed.";
+
+  // Import first on darwin, and only for a plain login. A user who already ran `muse
+  // login` keeps the zero-interaction path, and a device grant ends in a mint against a
+  // rate-limited endpoint, so starting one while a working credential sits on disk spends
+  // a request to arrive at the same key. `forceLogin` maps to "off" upstream because
+  // reimporting is how an add-account silently re-adds the account the user already has.
+  if (platform === "darwin" && options.importLocal !== "off") {
+    const imported = await importFromKeychain(ctrl, deps);
+    if (imported) return imported;
+  }
+
+  // fetchImpl/sleep/now are FORWARDED. Without this the device module would carry its own
+  // deps object and any test reaching this path would call auth.meta.com for real.
+  const device = deps.loginDevice
+    ?? (c => loginMetaMuseDevice(c, {
+      ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+      ...(deps.sleep ? { sleep: deps.sleep } : {}),
+      ...(deps.now ? { now: deps.now } : {}),
+    }));
+  try {
+    ctrl.onProgress?.("Starting the Meta device login...");
+    return await device(ctrl);
+  } catch (error) {
+    // A cancelled login must never be answered with a paste prompt.
+    if (isCancellation(error, ctrl)) throw error;
+    const reason = deviceFailureReason(error);
     const pasted = await manualKeyCredential(ctrl, reason);
-    if (pasted === null) {
-      throw new Error(
-        `${reason} This client cannot prompt for a key, so run \`ocx login meta-muse\` from the CLI `
-          + `or the dashboard and paste yours from ${MANUAL_KEY_URL}, `
-          + "or use the meta-model provider with your own key (META_MODEL_API_KEY).",
-      );
-    }
+    // No paste surface, or an empty paste. The refusal KEEPS the guidance the previous
+    // implementation gave; a device error must not replace it.
+    if (pasted === null) throw noPasteSurfaceError(platform, reason);
     return await validatedMetaMuseCredential(pasted, ctrl, deps, undefined, "manual");
   }
+}
 
+/**
+ * Adopt the credential the Muse Code CLI already holds, or report that there is none.
+ *
+ * Returns null for the two conditions that genuinely mean "nothing here to import", so the
+ * caller can offer a device grant instead of a dead end. Everything else still throws: a
+ * corrupt file, an unmeasured storage backend, a Keychain read that times out, and a
+ * Keychain entry that is unreadable or carries no usable key are all cases where a
+ * credential probably EXISTS, and silently starting a browser grant would create a second
+ * login to work around a permissions dialog.
+ */
+async function importFromKeychain(
+  ctrl: OAuthController,
+  deps: MuseImportDeps,
+): Promise<OAuthCredentials | null> {
   const pointerRaw = await (deps.readPointer ?? defaultReadPointer)();
-  if (pointerRaw === null) {
-    throw new Error(`Muse Code CLI credential not found at ${MUSE_POINTER_PATH}. ${INSTALL_HINT}`);
-  }
+  if (pointerRaw === null) return null;
 
   let pointer: MusePointer;
   try {
@@ -208,9 +239,7 @@ export async function loginMetaMuse(
   }
 
   const meta = pointer.providers?.meta;
-  if (!meta || meta.mechanism !== "oauth") {
-    throw new Error("The Muse Code credential file has no signed-in Meta account. Run `muse login`, then retry.");
-  }
+  if (!meta || meta.mechanism !== "oauth") return null;
   // A different storage backend is a shape we have not measured; refuse rather than guess.
   if (meta.storage !== "keychain") {
     throw new Error(
@@ -218,10 +247,12 @@ export async function loginMetaMuse(
     );
   }
 
+  // ctrl.signal is handed to the reader, not dropped: the caller can cancel a Keychain
+  // prompt nobody is going to answer.
   const secretRaw = await (deps.readKeychain ?? defaultReadKeychain)(ctrl.signal);
   if (secretRaw === null) {
     throw new Error(
-      "Could not read the Muse Code credential from the macOS Keychain within 5s. Approve the Keychain prompt, or run `muse login` again.",
+      "Could not read the Muse Code credential from the macOS Keychain within 5s. Approve the Keychain prompt, or run `muse login` again, or add the account again to sign in with a browser code instead.",
     );
   }
 
@@ -242,6 +273,57 @@ export async function loginMetaMuse(
   );
 }
 
+/** A cancelled login is not a failed login, and must not be answered with a prompt. */
+function isCancellation(error: unknown, ctrl: OAuthController): boolean {
+  if (ctrl.signal?.aborted) return true;
+  if (error instanceof MuseDeviceLoginError) return error.kind === "cancelled";
+  return error instanceof Error && error.name === "AbortError";
+}
+
+/** One line above the paste field saying why it appeared. Never includes a credential. */
+function deviceFailureReason(error: unknown): string {
+  if (error instanceof MuseDeviceLoginError) {
+    switch (error.kind) {
+      case "subscription-inactive":
+        return "This Meta account has no active Muse Code subscription.";
+      case "entitlement-required":
+        return error.message;
+      case "mint-rate-limited":
+        return "Meta rate-limited the Muse Code key request.";
+      case "device-denied":
+        return "The browser approval was denied.";
+      case "device-expired":
+        return "The device code expired before it was approved.";
+      default:
+        return "The Meta device login did not complete.";
+    }
+  }
+  return "The Meta device login did not complete.";
+}
+
+/**
+ * The refusal for a host that can neither finish a grant nor accept a paste.
+ *
+ * Composed, not substituted. A host in this position needs to be told where the key lives,
+ * which is what the previous implementation said and what three existing tests assert. The
+ * non-darwin clause is retained for the same reason: Meta ships no Windows CLI and the
+ * Linux credential shape has never been measured, and collapsing those into one message
+ * would tell a Linux user something false about their own machine.
+ */
+function noPasteSurfaceError(platform: string, reason: string): Error {
+  const platformClause = platform === "darwin"
+    ? ""
+    : platform === "win32"
+      ? " Meta ships no native Windows Muse Code CLI, so there is no credential to import."
+      : " The Muse Code CLI runs here, but where it stores its credential has not been measured, "
+        + "so importing one is refused rather than guessed.";
+  return new Error(
+    `${reason}${platformClause} This client cannot prompt for a key, so run \`ocx login meta-muse\` from the CLI `
+      + `or the dashboard and paste yours from ${MANUAL_KEY_URL}, `
+      + "or use the meta-model provider with your own key (META_MODEL_API_KEY).",
+  );
+}
+
 /**
  * The single gate every credential passes, imported or pasted.
  *
@@ -332,6 +414,15 @@ export async function refreshMetaMuseToken(
     access: apiKey,
     refresh: apiKey,
     expires: Number.MAX_SAFE_INTEGER,
-    source: credential?.source === "manual" ? "manual" : "local-cli",
+    // Preserve the provenance the slot already recorded. A device login is "oauth";
+    // relabelling it "local-cli" would misreport where the credential came from, the same
+    // failure this function comment already warns about for "manual".
+    source: credential?.source === "manual" || credential?.source === "oauth"
+      ? credential.source
+      : "local-cli",
+    // The account token is not re-derivable: Meta rejects refresh_token grants on this
+    // client (001 A). Dropping it here would silently cost the on-demand quota probe with
+    // no way back except a full re-login.
+    ...(credential?.muse ? { muse: credential.muse } : {}),
   };
 }

package/src/oauth/pool-kernel.ts

@@ -41,6 +41,15 @@ export function parseAccountPoolStrategy(raw: unknown): OcxAccountPoolRotationSt
   return null;
 }
 
+/** Codex alone supports ordering by the next shared quota reset. */
+export function parseCodexAccountPoolStrategy(raw: unknown): OcxAccountPoolRotationStrategy | "reset-first" | null {
+  return raw === "reset-first" ? raw : parseAccountPoolStrategy(raw);
+}
+
+export function normalizeCodexAccountPoolStrategy(raw: unknown): OcxAccountPoolRotationStrategy | "reset-first" {
+  return parseCodexAccountPoolStrategy(raw) ?? DEFAULT_STRATEGY;
+}
+
 /** Strict parse for management APIs — returns null instead of defaulting. */
 export function parseAccountPoolStickyLimit(raw: unknown): number | null {
   if (typeof raw === "number" && Number.isInteger(raw) && raw >= MIN_STICKY_LIMIT && raw <= MAX_STICKY_LIMIT) {

package/src/oauth/pool-settings-capability.ts

@@ -1,5 +1,5 @@
 import { isGenericFailoverProvider } from "./generic-account-failover";
-import { parseAccountPoolStickyLimit, parseAccountPoolStrategy } from "./pool-kernel";
+import { parseAccountPoolStickyLimit, parseAccountPoolStrategy, parseCodexAccountPoolStrategy } from "./pool-kernel";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 
 /**
@@ -147,7 +147,7 @@ export function unifiedPoolSettingsDto(
       // honest answer is "not a field here" rather than a fabricated true.
       enabled: null,
       enabledEffective: true,
-      strategy: parseGenericPoolStrategy(config.accountPoolStrategy) ?? "quota",
+      strategy: parseCodexAccountPoolStrategy(config.accountPoolStrategy) ?? "quota",
       stickyLimit: parseGenericStickyLimit(config.accountPoolStickyLimit) ?? 1,
       autoSwitchThreshold: parseGenericAutoSwitchThreshold(config.autoSwitchThreshold) ?? 80,
       quotaWindow: null,

package/src/oauth/store.ts

@@ -490,6 +490,30 @@ function normalizeCredential(cred: unknown): OAuthCredentials | null {
       };
     }
   }
+  if (candidate.muse && typeof candidate.muse === "object") {
+    const muse = candidate.muse;
+    const cleanMuse = (value: unknown, max: number): string | undefined => {
+      if (typeof value !== "string") return undefined;
+      const trimmed = value.trim();
+      return trimmed && trimmed.length <= max && !/[\x00-\x1f\x7f]/.test(trimmed) ? trimmed : undefined;
+    };
+    const oauthAccessToken = cleanMuse(muse.oauthAccessToken, 4096);
+    const userId = cleanMuse(muse.userId, 128);
+    const tierName = cleanMuse(muse.tierName, 128);
+    const mintedAt = typeof muse.mintedAt === "number" && Number.isFinite(muse.mintedAt)
+      ? muse.mintedAt
+      : undefined;
+    // oauthAccessToken is the only load-bearing member: without it there is nothing to
+    // mint or probe with, and a row carrying only a tier label would be noise.
+    if (oauthAccessToken) {
+      normalized.muse = {
+        oauthAccessToken,
+        ...(userId ? { userId } : {}),
+        ...(tierName ? { tierName } : {}),
+        ...(mintedAt !== undefined ? { mintedAt } : {}),
+      };
+    }
+  }
   return normalized;
 }
 
@@ -1024,6 +1048,39 @@ export async function replaceProviderAccountSet(
   }, [provider, set]);
 }
 
+export type ProviderCredentialRekeyOutcome = "moved" | "absent" | "conflict";
+
+/**
+ * Move a provider's whole account set to a different provider key.
+ *
+ * Used by provider-id merge migrations (e.g. devin-cli -> devin): the
+ * credential itself stays valid under the canonical id, only the slot name is
+ * stale. The move goes through mutateStore so it takes the same file lock and
+ * revision bookkeeping as every other auth.json write.
+ *
+ * Both slots occupied is a REFUSAL, not a merge: two account sets may belong
+ * to different humans, and picking a survivor is a user decision, so the
+ * outcome is reported and both are left in place.
+ *
+ * Orphaned auth.refresh.<provider>.<hash>.json intent files are not moved.
+ * They are keyed by provider name plus an account-id hash, so a file left
+ * under the old id simply never matches a lookup again — harmless litter, and
+ * rewriting them would have to guess at an intent's in-flight state anyway.
+ */
+export async function rekeyProviderCredentials(
+  from: string,
+  to: string,
+): Promise<ProviderCredentialRekeyOutcome> {
+  return await mutateStore(store => {
+    const source = store[from];
+    if (!source) return "absent";
+    if (store[to]) return "conflict";
+    store[to] = source;
+    delete store[from];
+    return "moved";
+  }, [from, to]);
+}
+
 export async function markAccountNeedsReauth(
   provider: string,
   accountId: string,

package/src/oauth/types.ts

@@ -25,6 +25,35 @@ export interface KiroOAuthMetadata {
   authType?: KiroCredentialAuthType;
 }
 
+/**
+ * Account-scoped Muse Code data that is NOT the request bearer.
+ *
+ * The Model API is authenticated by the `LLM|` key in `access`; this token authenticates
+ * the Meta ACCOUNT and exists only to mint that key and to read subscription usage
+ * (devlog/_plan/260912_muse_device_oauth/002 A). Keeping it out of `access` is what lets
+ * every request path stay unchanged.
+ *
+ * It must never be added to `OAuthAccountSummary` (src/oauth/index.ts:1803) or to
+ * `OAuthAccessSnapshot` (src/oauth/index.ts:85-100). Both are hand-built allowlists, and
+ * that construction — not a redactor — is what keeps a secret out of a response.
+ */
+export interface MuseOAuthMetadata {
+  /** Meta account access token from the device grant. Never sent to api.meta.ai/v1. */
+  oauthAccessToken: string;
+  /**
+   * The stable Meta account id. Kept HERE rather than in `accountId` on purpose (wp2
+   * audit fold W2): the store keys a slot on `accountId ?? email`, and this provider
+   * import path has always supplied email only. Promoting `user_id` to `accountId` would
+   * make a device login fail to match the row an imported login already created, giving
+   * one human two accounts.
+   */
+  userId?: string;
+  /** Epoch ms of the mint that produced the stored key. */
+  mintedAt?: number;
+  /** Subscription tier label as Meta reported it. Display only. */
+  tierName?: string;
+}
+
 export type OAuthCredentials = {
   refresh: string;
   access: string;
@@ -42,6 +71,8 @@ export type OAuthCredentials = {
   apiBaseUrl?: string;
   /** Never returned by management APIs; persisted only inside the protected auth-store boundary. */
   kiro?: KiroOAuthMetadata;
+  /** Never returned by management APIs; persisted only inside the protected auth-store boundary. */
+  muse?: MuseOAuthMetadata;
 };
 
 /** One logged-in account inside a provider's account set (multiauth). */

package/src/providers/derive.ts

@@ -44,6 +44,7 @@ export interface DerivedKeyLoginProvider {
   autoToolChoiceOnlyModels?: string[];
   preserveReasoningContentModels?: string[];
   requiresReasoningPlaceholderModels?: string[];
+  showThinkingSummary?: boolean;
   reasoningSplitModels?: string[];
   reasoningDetailsModels?: string[];
   thinkingToggleModels?: string[];
@@ -271,6 +272,7 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     ...(entry.autoToolChoiceOnlyModels ? { autoToolChoiceOnlyModels: [...entry.autoToolChoiceOnlyModels] } : {}),
     ...(entry.preserveReasoningContentModels ? { preserveReasoningContentModels: [...entry.preserveReasoningContentModels] } : {}),
     ...(entry.requiresReasoningPlaceholderModels ? { requiresReasoningPlaceholderModels: [...entry.requiresReasoningPlaceholderModels] } : {}),
+    ...(entry.showThinkingSummary !== undefined ? { showThinkingSummary: entry.showThinkingSummary } : {}),
     ...(entry.reasoningSplitModels ? { reasoningSplitModels: [...entry.reasoningSplitModels] } : {}),
     ...(entry.reasoningDetailsModels ? { reasoningDetailsModels: [...entry.reasoningDetailsModels] } : {}),
     ...(entry.thinkingToggleModels ? { thinkingToggleModels: [...entry.thinkingToggleModels] } : {}),
@@ -320,6 +322,7 @@ export function deriveKeyLoginMap(): Record<string, DerivedKeyLoginProvider> {
       ...(entry.autoToolChoiceOnlyModels ? { autoToolChoiceOnlyModels: [...entry.autoToolChoiceOnlyModels] } : {}),
       ...(entry.preserveReasoningContentModels ? { preserveReasoningContentModels: [...entry.preserveReasoningContentModels] } : {}),
       ...(entry.requiresReasoningPlaceholderModels ? { requiresReasoningPlaceholderModels: [...entry.requiresReasoningPlaceholderModels] } : {}),
+      ...(entry.showThinkingSummary !== undefined ? { showThinkingSummary: entry.showThinkingSummary } : {}),
       ...(entry.reasoningSplitModels ? { reasoningSplitModels: [...entry.reasoningSplitModels] } : {}),
       ...(entry.reasoningDetailsModels ? { reasoningDetailsModels: [...entry.reasoningDetailsModels] } : {}),
       ...(entry.thinkingToggleModels ? { thinkingToggleModels: [...entry.thinkingToggleModels] } : {}),
@@ -441,13 +444,19 @@ function applyVerbosityDefaults(prov: OcxProviderConfig, entry: ProviderRegistry
  * was skipped and the reasoning ladder was advertised without summary support — exactly the
  * inconsistency that makes Codex drop the inbound reasoning object.
  *
- * Deliberately narrow: only the reasoning-summary map, and only via
+ * Deliberately narrow: reasoning-summary and effort metadata only, via
  * `registryEntryForProviderDestination`, which matches fixed key destinations and refuses
  * templated or overridable base URLs. A custom row keeps its own identity for everything else.
  */
-function enrichReasoningSummariesByDestination(prov: OcxProviderConfig): void {
+function enrichReasoningMetadataByDestination(prov: OcxProviderConfig): void {
   const destination = registryEntryForProviderDestination(prov);
   applyReasoningSummaryDefaults(prov, destination?.modelSupportsReasoningSummaries);
+  if (destination?.modelReasoningEfforts) {
+    prov.modelReasoningEfforts = fillRecordOfArrays(destination.modelReasoningEfforts, prov.modelReasoningEfforts);
+  }
+  if (prov.reasoningEfforts === undefined && destination?.reasoningEfforts !== undefined) {
+    prov.reasoningEfforts = [...destination.reasoningEfforts];
+  }
 }
 
 /** Repair the exact low-only ClinePass ladder generated by older key-login presets. */
@@ -467,7 +476,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
     // `registryEntryForProviderDestination` answers the question that actually matters here —
     // which vendor endpoint is this row talking to — and is already restricted to fixed key
     // destinations, so a templated or overridable base URL cannot be claimed by it.
-    enrichReasoningSummariesByDestination(prov);
+    enrichReasoningMetadataByDestination(prov);
     applyServiceTierModelDefaults(prov, serviceTierModelDefaultsFor(registryEntryForProviderDestination(prov), prov));
     applyVerbosityDefaults(prov, registryEntryForProviderDestination(prov));
     return;
@@ -574,6 +583,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (!prov.thinkingToggleModels && seed.thinkingToggleModels) prov.thinkingToggleModels = [...seed.thinkingToggleModels];
   if (!prov.thinkingBudgetModels && seed.thinkingBudgetModels) prov.thinkingBudgetModels = [...seed.thinkingBudgetModels];
   if (prov.escapeBuiltinToolNames === undefined && seed.escapeBuiltinToolNames !== undefined) prov.escapeBuiltinToolNames = seed.escapeBuiltinToolNames;
+  if (prov.showThinkingSummary === undefined && seed.showThinkingSummary !== undefined) prov.showThinkingSummary = seed.showThinkingSummary;
   if (prov.keyOptional === undefined && seed.keyOptional !== undefined) prov.keyOptional = seed.keyOptional;
   if (prov.freeTier === undefined && seed.freeTier !== undefined) prov.freeTier = seed.freeTier;
   if (prov.modelSuffixBracketStrip === undefined && seed.modelSuffixBracketStrip !== undefined) prov.modelSuffixBracketStrip = seed.modelSuffixBracketStrip;

package/src/providers/devin-cli-authmode-migration.ts

@@ -1,23 +1,33 @@
 /**
- * Repair a saved `devin-cli` row that still claims `authMode: "local"`.
+ * Repair saved Devin rows written while `devin-cli` was a local ACP provider.
  *
- * `derive.ts` seeds `authMode` from the registry's `authKind`, so every config
- * written while `devin-cli` was a local provider carries `"local"`. The registry
- * now classifies it as an account provider, and the management write boundary
- * fails closed on that mismatch: `auth-cors.ts` rejects `authMode: "local"` when
- * the registry entry is not local. Without this, an existing install can no
- * longer save provider changes from the dashboard.
+ * `devin-cli` used to be a local provider whose adapter spawned `devin acp`;
+ * it later became an account provider on the shared `devin` adapter, and the
+ * registry id itself has since merged into `devin` outright
+ * (devlog/_plan/260913_devin_provider_merge).
  *
- * It rewrites exactly that one field, on exactly that mismatch. A row the user
- * retargeted at another adapter is left alone, and so is any other value.
+ * Only the adapter repair still lives here. The `authMode` half — rewriting
+ * `"local"` to `"oauth"` on the registry-id row — moved into
+ * devin-provider-merge-migration.ts, which normalizes the row as it moves the
+ * key: the `devin-cli` registry entry is gone, so the PROVIDER_REGISTRY lookup
+ * that gated the rewrite here could never fire again.
  *
- * It also WARNS, without changing anything, when the saved row still names the
- * ACP adapter. That field no longer selects the transport — `routedProviderConfig`
- * pins the adapter from the registry for any row whose name is a registry id — so
- * an operator who deliberately chose ACP would otherwise switch transports
- * silently. The warning names the custom-id row that still gets them ACP.
+ * The adapter repair must keep working for CUSTOM-NAMED rows. The ACP adapter
+ * was removed, so `"devin-cli"` is not a constructible adapter id and
+ * `createRegisteredAdapter` would throw `Unknown adapter: devin-cli`. The
+ * canonical `devin` row gets its adapter pinned from the registry by
+ * `routedProviderConfig`, but a row named e.g. `"devin-acp"` has nothing
+ * pinning it and would fail every request. So every row naming the retired
+ * adapter is rewritten to `devin`, whatever the row is called, and each
+ * rewrite is reported.
+ *
+ * A row carrying the retired ACP identity URL is repointed at the api-server
+ * in the same pass. That URL was never a destination — it existed only so
+ * provider validation would accept an `http(s)` scheme for a child process —
+ * so leaving it in place would turn a constructible adapter into a request
+ * that cannot resolve a host.
  */
-import { PROVIDER_REGISTRY } from "./registry";
+import { DEVIN_DEFAULT_API_SERVER } from "../oauth/devin/api-base";
 import type { OcxConfig } from "../types";
 
 export interface DevinCliAuthModeProjection {
@@ -26,32 +36,44 @@ export interface DevinCliAuthModeProjection {
   warnings: string[];
 }
 
-const ACP_ESCAPE_HATCH =
-  'a custom-named row still reaches it, e.g. "devin-acp": { "adapter": "devin-cli", "baseUrl": "https://cli.devin.ai" }';
+/** The adapter id the removed ACP transport was registered under. */
+const RETIRED_ACP_ADAPTER = "devin-cli";
+/** Identity-only URL the ACP rows carried; never a destination. */
+const RETIRED_ACP_IDENTITY_HOST = "cli.devin.ai";
+
+/** Exported for the merge migration, which applies the same rule to the row it moves. */
+export function isRetiredDevinAcpIdentityUrl(baseUrl: string | undefined): boolean {
+  if (typeof baseUrl !== "string") return false;
+  try {
+    return new URL(baseUrl).hostname.toLowerCase() === RETIRED_ACP_IDENTITY_HOST;
+  } catch {
+    return false;
+  }
+}
 
 export function projectDevinCliAuthMode(config: OcxConfig): DevinCliAuthModeProjection {
   const warnings: string[] = [];
-  const prov = config.providers?.["devin-cli"];
-  if (!prov) return { config, changed: false, warnings };
-
-  const entry = PROVIDER_REGISTRY.find(row => row.id === "devin-cli");
-  if (!entry || entry.authKind !== "oauth") return { config, changed: false, warnings };
+  let changed = false;
 
-  // Non-mutating: the saved adapter no longer decides the transport, so leaving
-  // it in place preserves nothing except a signal worth reporting once.
-  if (prov.adapter === "devin-cli") {
+  // Every row, not only the registry id: a custom-named row had no registry pin,
+  // so after the ACP removal it is the one that cannot construct an adapter.
+  for (const [name, row] of Object.entries(config.providers ?? {})) {
+    if (!row || row.adapter !== RETIRED_ACP_ADAPTER) continue;
+    row.adapter = "devin";
+    changed = true;
+    let detail = "";
+    if (isRetiredDevinAcpIdentityUrl(row.baseUrl)) {
+      // The shared default, not a second copy of the host: a migration that
+      // hardcodes it would keep writing the old address after the default moves.
+      row.baseUrl = DEVIN_DEFAULT_API_SERVER;
+      detail = ` and repointed its baseUrl at ${DEVIN_DEFAULT_API_SERVER}`;
+    }
     warnings.push(
-      'the saved "devin-cli" row names the ACP adapter, but that provider id now streams over '
-      + `Cognition's api-server and the adapter is pinned from the registry; for the CLI's own agent loop, ${ACP_ESCAPE_HATCH}.`,
+      `rewrote "${name}" adapter ${RETIRED_ACP_ADAPTER} -> devin${detail}: the local ACP transport `
+      + "was removed, and Devin now streams over Cognition's api-server with the credential the "
+      + "installed CLI already holds.",
     );
   }
 
-  if (prov.authMode !== "local") return { config, changed: warnings.length > 0 ? false : false, warnings };
-  prov.authMode = "oauth";
-  warnings.push(
-    'rewrote "devin-cli" authMode local -> oauth: the registry no longer classifies it as local, '
-    + "and the management write boundary fails closed on the mismatch.",
-  );
-  return { config, changed: true, warnings };
+  return { config, changed, warnings };
 }
-