@bitkyc08/opencodex 2.69.0 → 2.70.0

package/src/oauth/index.ts

@@ -30,6 +30,7 @@ import {
   type OAuthCredentialWriteReceipt,
   type OAuthRefreshIntent,
   type OAuthRefreshIntentCleanupPending,
+  type AuthStore,
 } from "./store";
 import { loginXai, refreshXaiToken, XAI_LOCAL_CLI_DETACH_WARNING, XaiTokenRequestError } from "./xai";
 import { ANTHROPIC_OAUTH_BETA, AnthropicTokenError, loginAnthropic, refreshAnthropicToken } from "./anthropic";
@@ -38,7 +39,7 @@ import { loginNous, NousTokenError, refreshNousToken, clearNousRefreshIntent, Re
 import { loginChatGPT, refreshChatGPTToken, type ChatGPTLoginFlow } from "./chatgpt";
 import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
 import { loginCursor, refreshCursorToken } from "./cursor";
-import { loginDevin, refreshDevinToken } from "./devin";
+import { assertDevinCliAdoptionOwnership, loginDevin, refreshDevinToken } from "./devin";
 import { validateDevinApiBaseUrl } from "./devin/api-base";
 import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUrl } from "./github-copilot";
 import { loginCommandCode, refreshCommandCodeToken } from "./command-code";
@@ -192,6 +193,8 @@ interface OAuthProviderDef {
     refreshToken: string,
     signal?: AbortSignal,
     credential?: OAuthCredentials,
+    /** Store row being refreshed; passed by the generic lock only. */
+    accountId?: string,
   ): Promise<OAuthCredentials>;
   /** provider entry written into config.json on first login. */
   providerConfig: OcxProviderConfig;
@@ -640,6 +643,7 @@ const FORCE_REFRESH_PROVIDERS = new Set([
   "kiro",
   "google-antigravity",
   "orcarouter-oauth",
+  "devin",
 ]);
 
 export async function forceRefreshOAuthAccessSnapshot(
@@ -848,7 +852,11 @@ function authoritative(stored:OAuthCredentials,active:boolean,now:()=>number):OA
 function merged(fresh: OAuthCredentials, previous: OAuthCredentials): OAuthCredentials {
   return {
     ...fresh,
-    source: previous.source === "local-cli" ? "oauth" : fresh.source ?? previous.source ?? "oauth",
+    // Shared: a refresh function returns "local-cli" only when the credential it hands back
+    // still is the local CLI's (Devin re-reading the CLI file, Meta Muse echoing its durable
+    // CLI key). Relabelling that "oauth" would stop the next forced refresh from re-reading it.
+    source: fresh.source === "local-cli" ? "local-cli"
+      : previous.source === "local-cli" ? "oauth" : fresh.source ?? previous.source ?? "oauth",
     ...(fresh.projectId === undefined && previous.projectId ? { projectId: previous.projectId } : {}),
     ...(fresh.apiBaseUrl === undefined && previous.apiBaseUrl ? { apiBaseUrl: previous.apiBaseUrl } : {}),
     ...(fresh.email === undefined && previous.email ? { email: previous.email } : {}),
@@ -1052,10 +1060,15 @@ export async function refreshGenericAccountWithLock(
     }
     const generation = credentialGeneration(stored);
     try {
-      const fresh = merged(await def.refresh(stored.refresh, deps.signal, stored), stored);
+      const refreshed = await def.refresh(stored.refresh, deps.signal, stored, accountId);
+      const fresh = merged(refreshed, stored);
       const outcome = await mergeAccountCredential(provider, accountId, fresh, {
         expectedGeneration: generation,
         afterPrePersistRead: deps.afterPrePersistRead,
+        ...(provider === "devin" ? { assertOwnership: (store: AuthStore) => {
+          if (store[provider]?.accounts.find(row => row.id === accountId)?.paused) throw new OAuthAccountPausedError();
+          assertDevinCliAdoptionOwnership(store, provider, accountId, refreshed);
+        } } : {}),
       });
       if (outcome.superseded) {
         if (outcome.stored.expires > Date.now() + REFRESH_SKEW_MS) return outcome.stored.access;
@@ -1575,6 +1588,10 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
   // Login used to rebuild the whole row from the preset, so catalog data refreshed
   // immediately. Keep that timing without overwriting unrelated operator-owned fields.
   applyOAuthPresetCatalog(next, providerConfig);
+  // The per-model Copilot tier is operator intent, not account or preset metadata.
+  if (existing?.modelContextTiers !== undefined) {
+    next.modelContextTiers = structuredClone(existing.modelContextTiers);
+  }
   // The original Command Code seed was an implementation-owned static catalog, not an
   // operator opt-out. Promote that exact legacy shape when OAuth login refreshes the row.
   if (provider === "command-code" && existing && isLegacyCommandCodeStaticCatalog(existing)) {

package/src/oauth/kiro-terminal-failover.ts

@@ -2,27 +2,41 @@ import type { OAuthAccessSnapshot } from "./index";
 import type { OcxConfig } from "../types";
 import { getValidAccessSnapshotForAccount } from "./index";
 import { credentialGeneration, getAccountCredentialWithStatus, getAccountSet } from "./store";
-import { eligibleFailoverAccounts, isGenericOAuthFailoverEnabled,
+import { eligibleFailoverAccounts, isGenericFailoverProvider,
   GENERIC_OAUTH_MAX_ACCOUNTS_PER_REQUEST } from "./generic-account-failover";
 
-/** Only an unchanged, allowlist-classified dead credential permits this alternate. */
-export async function tryKiroAlternateAfterTerminalRefresh(
-  config: OcxConfig, failedAccountId: string, failedGeneration: string,
+/**
+ * Only an unchanged, allowlist-classified dead credential permits this alternate.
+ *
+ * Consent is the stored-login count, needsReauth rows included: the refused account was
+ * marked needsReauth a moment ago, and counting only healthy rows would make a two-account
+ * setup look like one exactly when the second account is needed.
+ */
+export async function tryAlternateAfterTerminalRefresh(
+  config: OcxConfig, providerName: string, failedAccountId: string, failedGeneration: string,
 ): Promise<OAuthAccessSnapshot | null> {
-  if (!isGenericOAuthFailoverEnabled(config, "kiro")) return null;
-  const failed = getAccountCredentialWithStatus("kiro", failedAccountId);
+  const provider = config.providers?.[providerName];
+  if (!provider || !isGenericFailoverProvider(providerName, provider)) return null;
+  const order = getAccountSet(providerName)?.accounts.map(row => row.id) ?? [];
+  if (order.length < 2) return null;
+  const failed = getAccountCredentialWithStatus(providerName, failedAccountId);
   if (!failed?.needsReauth || credentialGeneration(failed.credential) !== failedGeneration) return null;
-  const order = getAccountSet("kiro")?.accounts.map(row => row.id) ?? [];
   const after = order.indexOf(failedAccountId);
   if (after < 0) return null;
   const ring = [...order.slice(after + 1), ...order.slice(0, after)];
-  const eligible = new Set(eligibleFailoverAccounts("kiro"));
+  const eligible = new Set(eligibleFailoverAccounts(providerName));
   let attempted = 0;
   for (const id of ring) {
     if (id === failedAccountId || !eligible.has(id)) continue;
     if (++attempted >= GENERIC_OAUTH_MAX_ACCOUNTS_PER_REQUEST) break;
-    try { return await getValidAccessSnapshotForAccount("kiro", id, { requireUsableAccount: true }); }
+    try { return await getValidAccessSnapshotForAccount(providerName, id, { requireUsableAccount: true }); }
     catch { /* Keep the original login-required result if every alternate is stale. */ }
   }
   return null;
 }
+
+export function tryKiroAlternateAfterTerminalRefresh(
+  config: OcxConfig, failedAccountId: string, failedGeneration: string,
+): Promise<OAuthAccessSnapshot | null> {
+  return tryAlternateAfterTerminalRefresh(config, "kiro", failedAccountId, failedGeneration);
+}

package/src/oauth/pool-settings-capability.ts

@@ -1,6 +1,8 @@
 import { isGenericFailoverProvider } from "./generic-account-failover";
 import { parseAccountPoolStickyLimit, parseAccountPoolStrategy, parseCodexAccountPoolStrategy } from "./pool-kernel";
 import type { OcxConfig, OcxProviderConfig } from "../types";
+import type { AnthropicModelRoute } from "../types/config";
+import { readAnthropicModelRoutes } from "./anthropic-model-routes";
 
 /**
  * Which pool-settings contract a provider speaks (#695, slice 1).
@@ -48,7 +50,7 @@ export function parseGenericStickyLimit(value: unknown): number | null {
 
 /** Fields the unified pool-settings contract can carry, per kind. */
 export const POOL_SETTINGS_FIELDS = [
-  "enabled", "strategy", "stickyLimit", "autoSwitchThreshold", "quotaWindow", "maxConcurrentPerAccount",
+  "enabled", "strategy", "stickyLimit", "autoSwitchThreshold", "quotaWindow", "maxConcurrentPerAccount", "routes",
 ] as const;
 export type PoolSettingsField = typeof POOL_SETTINGS_FIELDS[number];
 
@@ -81,6 +83,9 @@ export interface PoolSettingsDto {
   autoSwitchThreshold: number | null;
   quotaWindow: string | null;
   maxConcurrentPerAccount: number | null;
+  routes: AnthropicModelRoute[] | null;
+  /** Present only when stored Anthropic routes fail validation on read. */
+  routesError?: string;
 }
 
 
@@ -129,7 +134,7 @@ export function genericPoolSettingsDto(
 /** Which fields each kind actually honours. Declared, never silently omitted. */
 const SUPPORTED_BY_KIND: Record<PoolSettingsKind, PoolSettingsField[]> = {
   codex: ["strategy", "stickyLimit", "autoSwitchThreshold"],
-  anthropic: ["enabled", "strategy", "stickyLimit", "autoSwitchThreshold", "quotaWindow"],
+  anthropic: ["enabled", "strategy", "stickyLimit", "autoSwitchThreshold", "quotaWindow", "routes"],
   generic: ["enabled", "strategy", "stickyLimit", "autoSwitchThreshold"],
 };
 
@@ -159,6 +164,7 @@ export function unifiedPoolSettingsDto(
       autoSwitchThreshold: parseGenericAutoSwitchThreshold(config.autoSwitchThreshold) ?? 80,
       quotaWindow: null,
       maxConcurrentPerAccount: null,
+      routes: null,
     };
   }
   if (kind === "anthropic") {
@@ -173,6 +179,7 @@ export function unifiedPoolSettingsDto(
       autoSwitchThreshold: parseGenericAutoSwitchThreshold(pool.autoSwitchThreshold) ?? 80,
       quotaWindow: typeof pool.quotaWindow === "string" ? pool.quotaWindow : "five-hour",
       maxConcurrentPerAccount: null,
+      ...readAnthropicModelRoutes(pool.routes),
     };
   }
   const failover = config.providers?.[provider]?.oauthAccountFailover ?? {};
@@ -190,5 +197,6 @@ export function unifiedPoolSettingsDto(
     autoSwitchThreshold: parseGenericAutoSwitchThreshold(failover.autoSwitchThreshold),
     quotaWindow: null,
     maxConcurrentPerAccount: provider === "kiro" ? parseKiroAccountCap(failover.maxConcurrentPerAccount) : null,
+    routes: null,
   };
 }

package/src/oauth/store.ts

@@ -1379,5 +1379,5 @@ export async function markAccountNeedsReauth(
   }, [provider, accountId]);
 }
 
-export async function mergeAccountCredential(provider:string,accountId:string,credential:OAuthCredentials,opts:{expectedGeneration?:string;afterPrePersistRead?:()=>void|Promise<void>}={}):Promise<{superseded:false}|{superseded:true;stored:OAuthCredentials}>{const safe=normalizeCredential(credential);if(!safe)throw new Error("Refusing to persist invalid OAuth credential");return await mutateStore(async store=>{await opts.afterPrePersistRead?.();const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account)throw new Error(`OAuth account disappeared before persist: ${provider}`);if(opts.expectedGeneration!==undefined&&credentialGeneration(account.credential)!==opts.expectedGeneration)return{superseded:true,stored:account.credential};account.credential=safe;delete account.needsReauth;return{superseded:false};},[provider,accountId,safe,opts.expectedGeneration]);}
+export async function mergeAccountCredential(provider:string,accountId:string,credential:OAuthCredentials,opts:{expectedGeneration?:string;afterPrePersistRead?:()=>void|Promise<void>;assertOwnership?: (store: AuthStore) => void}={}):Promise<{superseded:false}|{superseded:true;stored:OAuthCredentials}>{const safe=normalizeCredential(credential);if(!safe)throw new Error("Refusing to persist invalid OAuth credential");return await mutateStore(async store=>{await opts.afterPrePersistRead?.();const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account)throw new Error(`OAuth account disappeared before persist: ${provider}`);if(opts.expectedGeneration!==undefined&&credentialGeneration(account.credential)!==opts.expectedGeneration)return{superseded:true,stored:account.credential};opts.assertOwnership?.(store);account.credential=safe;delete account.needsReauth;return{superseded:false};},[provider,accountId,safe,opts.expectedGeneration]);}
 export async function markAccountNeedsReauthIfGeneration(provider:string,accountId:string,generation:string,writerGeneration=captureConfigGeneration()):Promise<boolean>{const key=oauthAccountKey(provider,accountId);if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;return await mutateStore(store=>{const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account?.credential||credentialGeneration(account.credential)!==generation)return false;if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;account.needsReauth=true;return true;},[provider,accountId,generation]);}

package/src/protocols/encoders/adapter-events.ts

@@ -136,6 +136,8 @@ export interface ClientEncodeHooks {
 export interface AdapterEventEncodeOptions {
   translatorBudget: TranslatorBudget;
   hideThinkingSummary?: boolean;
+  /** Provider policy: suppress raw content-channel reasoning, keep provider-authored summaries. */
+  hideRawReasoning?: boolean;
   toolNsMap?: ReadonlyMap<string, { namespace: string; name: string; freeform?: true }>;
   declaredToolNames?: ReadonlySet<string>;
   toolParameterSchemas?: ReadonlyMap<string, Record<string, unknown>>;
@@ -613,7 +615,7 @@ export function encodeAdapterEventStream(
             break;
           }
           case "reasoning_raw_delta": {
-            if (options.hideThinkingSummary) {
+            if (options.hideThinkingSummary || options.hideRawReasoning) {
               hiddenRawBytes += Buffer.byteLength(event.text);
               break;
             }

package/src/providers/github-copilot-context.ts

@@ -0,0 +1,27 @@
+import { modelRecordValue } from "../reasoning-effort";
+import type { OcxProviderConfig } from "../types";
+
+export function configuredGithubCopilotContextTier(provider: OcxProviderConfig, modelId: string): "default" | "long_context" | undefined {
+  const tier = modelRecordValue(provider.modelContextTiers, modelId);
+  return tier === "default" || tier === "long_context" ? tier : undefined;
+}
+
+/** Only the routed Copilot provider may receive this nonstandard upstream field. */
+export function applyGithubCopilotContextTier(
+  body: unknown, provider: OcxProviderConfig, modelId: string, providerName?: string,
+): unknown {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return body;
+  const tier = providerName === "github-copilot" ? configuredGithubCopilotContextTier(provider, modelId) : undefined;
+  return tier === undefined ? body : { ...body, contextTier: tier };
+}
+
+export function githubCopilotCatalogContextWindow(
+  providerName: string, provider: OcxProviderConfig, modelId: string, current: number | undefined,
+): number | undefined {
+  if (providerName !== "github-copilot" || configuredGithubCopilotContextTier(provider, modelId) !== "long_context") return current;
+  // The tier choice alone is not evidence of a larger window. An exact per-model declaration
+  // from the operator or captured registry is authoritative; it can also cap a live window.
+  const supported = provider.modelContextWindows && Object.hasOwn(provider.modelContextWindows, modelId)
+    ? provider.modelContextWindows[modelId] : undefined;
+  return typeof supported === "number" && Number.isSafeInteger(supported) && supported > 0 ? supported : current;
+}

package/src/providers/kiro-models.ts

@@ -7,6 +7,9 @@ export const KIRO_MODELS = [
   // 260923 preemptive: GPT-6 Sol and Luna (OpenAI announced 2026-09-22) added ahead of this provider's own catalog; mirrors the GPT-5.6 Sol/Luna rows. Calls fail upstream until Kiro ships the models.
   "gpt-6-sol",
   "gpt-6-luna",
+  // 260929 preemptive: Claude Sonnet 5.5 added ahead of Kiro's catalog (kiro.dev did not list it on
+  // 2026-09-29). Mirrors claude-sonnet-5; calls fail upstream until Kiro ships the model.
+  "claude-sonnet-5.5",
   "claude-sonnet-5",
   // 260923 preemptive: Claude Opus 5.5 added ahead of Kiro's catalog (kiro.dev did not list it on
   // 2026-09-23). Mirrors claude-opus-5; calls fail upstream until Kiro ships the model.
@@ -37,6 +40,7 @@ export const KIRO_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   "gpt-5.6-luna": 1_000_000,
   "gpt-6-sol": 272_000,
   "gpt-6-luna": 272_000,
+  "claude-sonnet-5.5": 1_000_000,
   "claude-sonnet-5": 1_000_000,
   "claude-opus-5.5": 1_000_000,
   "claude-opus-5": 1_000_000,

package/src/providers/model-rename-fields.ts

@@ -10,6 +10,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   defaultAliases: "none",
   adapter: "none",
   codexToolMode: "none",
+  projectContext: "none",
   requestPacing: "nested-models",
   mcpMaxTools: "none",
   mcpMaxSchemaBytes: "none",
@@ -57,6 +58,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   modelPreset: "none",
   contextWindow: "none",
   modelContextWindows: "record",
+  modelContextTiers: "record",
   modelInputModalities: "record",
   modelCapabilities: "record",
   modelMaxInputTokens: "record",
@@ -120,6 +122,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   preserveReasoningContentModels: "list",
   requiresReasoningPlaceholderModels: "list",
   showThinkingSummary: "none",
+  hideRawReasoning: "none",
   retryOn429: "none",
   transientRetryOn5xx: "none",
   retryOnReset: "none",

package/src/providers/quota/account-cache.ts

@@ -180,7 +180,8 @@ export function supportsPerAccountQuota(provider: string): boolean {
 }
 
 export function explicitAccountReader(provider: string): boolean {
-  return provider === "xai" || provider === "cursor" || provider === "kimi" || provider === "command-code";
+  return provider === "xai" || provider === "cursor" || provider === "kimi" || provider === "command-code"
+    || provider === "devin";
 }
 
 export function providerOAuthAccountQuotaMode(provider: string): AccountQuotaMode {
@@ -479,6 +480,9 @@ export function quotaCredentialIdentity(provider: string, accountId: string, cre
     provider, accountId, credential.access, credential.refresh, credential.expires,
     credential.accountId, credential.projectId, credential.source,
     target.adapter, target.baseUrl, target.authMode, target.disabled === true,
+    // Only credentials that carry their own endpoint (Devin tenants) extend the identity, so
+    // every other provider's existing cache keys stay valid.
+    ...(provider === "devin" && credential.apiBaseUrl ? [credential.apiBaseUrl] : []),
   ])).digest("hex");
 }
 
@@ -486,6 +490,7 @@ export function explicitQuotaDestination(provider: string, config: OcxProviderCo
   if (config.disabled === true || config.authMode !== "oauth") return false;
   if (provider === "kimi") return isCanonicalKimiCodeBaseUrl(config.baseUrl);
   if (provider === "command-code") return isCanonicalCommandCodeBaseUrl(config.baseUrl);
-  // These readers use fixed canonical billing origins, never config.baseUrl.
-  return provider === "xai" || provider === "cursor";
+  // These readers use fixed canonical billing origins, never config.baseUrl. Devin reads
+  // the credential's own allowlisted api-server host instead (fetchDevinQuota revalidates it).
+  return provider === "xai" || provider === "cursor" || provider === "devin";
 }

package/src/providers/quota/devin.ts

@@ -0,0 +1,286 @@
+/**
+ * Devin (Cognition) account quota from `SeatManagementService/GetUserStatus`.
+ *
+ * Cognition has no REST usage endpoint; plan, credit balances and the dated quota windows
+ * all come back from this one unary Connect RPC. The request carries the long-lived api_key
+ * inside the protobuf Metadata, so the host passes the same allowlist every other Devin RPC
+ * uses, redirects are refused, and no response body is ever echoed.
+ *
+ * Field map, confirmed against a live account:
+ *
+ *   GetUserStatusResponse { #1 UserStatus, #2 PlanInfo }
+ *   UserStatus            { #10 teams_tier, #13 PlanStatus }
+ *   PlanStatus            { #1 PlanInfo, #3 plan_end (Timestamp),
+ *                           #4 available_flex, #5 used_flow, #6 used_prompt, #7 used_flex,
+ *                           #8 available_prompt, #9 available_flow (int32; -1 = unlimited),
+ *                           #14 daily_remaining_percent, #15 weekly_remaining_percent,
+ *                           #16 overage_balance_micros (int64, may be negative),
+ *                           #17 daily_reset_unix, #18 weekly_reset_unix }
+ *   PlanInfo              { #1 teams_tier, #2 plan_name, #13 monthly_flow, #35 billing_strategy,
+ *                           #36 hide_daily_quota, #37 hide_weekly_quota }
+ */
+import { buildMetadata } from "../../adapters/devin/cloud-direct/metadata";
+import { encodeMessage } from "../../adapters/devin/cloud-direct/wire";
+import { resolveDevinApiBaseUrl, validateDevinApiBaseUrl } from "../../oauth/devin/api-base";
+import { readBoundedResponseBytes } from "../../lib/bounded-body";
+import { epochMillis, QUOTA_RESPONSE_MAX_BYTES, REQUEST_TIMEOUT_MS } from "../quota-wire";
+import type { ProviderQuota, ProviderQuotaWindow } from "../quota-types";
+import { AUTHORITATIVE_EMPTY_QUOTA, report, TERMINAL_QUOTA_FAILURE, type ProviderQuotaProbeResult } from "./report-cache";
+
+const GET_USER_STATUS_PATH = "/exa.seat_management_pb.SeatManagementService/GetUserStatus";
+const BILLING_STRATEGY_CREDITS = 1;
+const RESPONSE_WIRES = new Map([[1, 2], [2, 2]]);
+const USER_WIRES = new Map([[10, 0], [13, 2]]);
+const STATUS_WIRES = new Map<number, number>([[1, 2], [3, 2], ...[4, 5, 6, 7, 8, 9, 14, 15, 16, 17, 18].map(n => [n, 0] as const)]);
+const PLAN_WIRES = new Map([[1, 0], [2, 2], [13, 0], [35, 0], [36, 0], [37, 0]]);
+const TIMESTAMP_WIRES = new Map([[1, 0], [2, 0]]);
+
+export interface DevinPlanInfo {
+  teamsTier: number;
+  planName: string;
+  monthlyFlowCredits: number;
+  billingStrategy: number;
+  hideDailyQuota: boolean;
+  hideWeeklyQuota: boolean;
+}
+
+export interface DevinUserStatus {
+  plan: DevinPlanInfo;
+  planEndMs?: number;
+  usedPromptCredits: number;
+  availablePromptCredits: number;
+  usedFlowCredits: number;
+  availableFlowCredits: number;
+  usedFlexCredits: number;
+  availableFlexCredits: number;
+  dailyRemainingPercent: number;
+  weeklyRemainingPercent: number;
+  dailyResetMs?: number;
+  weeklyResetMs?: number;
+  overageBalanceMicros: number;
+  promptCreditBalancePresent: boolean;
+}
+
+type Fields = Map<number, bigint | Buffer>;
+
+/**
+ * Last occurrence wins. Parse locally so an overlong varint, truncated field, or wrong wire
+ * type for a known status field cannot turn a malformed credential-bearing RPC into quota.
+ */
+function fieldsOf(buf: Buffer | undefined, known: Map<number, number>): Fields | null {
+  const out: Fields = new Map();
+  if (!buf) return out;
+  let offset = 0;
+  const varint = (): bigint | null => {
+    let value = 0n;
+    for (let byte = 0; byte < 10; byte++) {
+      if (offset >= buf.length) return null;
+      const part = buf[offset++];
+      if (byte === 9 && part > 1) return null;
+      value |= BigInt(part & 0x7f) << BigInt(byte * 7);
+      if (!(part & 0x80)) return value;
+    }
+    return null;
+  };
+  while (offset < buf.length) {
+    const tag = varint();
+    if (tag === null || tag > 0xffffffffn) return null;
+    const num = Number(tag >> 3n);
+    const wire = Number(tag & 7n);
+    if (num === 0 || (known.has(num) && known.get(num) !== wire)) return null;
+    if (wire === 0) {
+      const value = varint();
+      if (value === null) return null;
+      out.set(num, value);
+    } else if (wire === 1 || wire === 5) {
+      const size = wire === 1 ? 8 : 4;
+      if (size > buf.length - offset) return null;
+      out.set(num, buf.subarray(offset, offset + size));
+      offset += size;
+    } else if (wire === 2) {
+      const length = varint();
+      if (length === null || length > BigInt(buf.length - offset)) return null;
+      const end = offset + Number(length);
+      out.set(num, buf.subarray(offset, end));
+      offset = end;
+    } else return null;
+  }
+  return out;
+}
+
+/** int32/int64 on the wire are two's-complement varints; -1 arrives as 2^64-1. */
+function int(fields: Fields, num: number): number {
+  const value = fields.get(num);
+  return typeof value === "bigint" ? Number(BigInt.asIntN(64, value)) : 0;
+}
+
+function sub(fields: Fields, num: number): Buffer | undefined {
+  const value = fields.get(num);
+  return Buffer.isBuffer(value) ? value : undefined;
+}
+
+/** Undefined for an absent timestamp; null for one that is present but malformed. */
+function timestampMs(buf: Buffer | undefined): number | undefined | null {
+  if (!buf) return undefined;
+  const f = fieldsOf(buf, TIMESTAMP_WIRES);
+  return f ? epochMillis(int(f, 1)) : null;
+}
+
+/** Null when neither plan copy is present: a zero-valued plan would read as an exhausted account. */
+function decodePlanInfo(buf: Buffer | undefined): DevinPlanInfo | null {
+  if (!buf) return null;
+  const f = fieldsOf(buf, PLAN_WIRES);
+  if (!f) return null;
+  return {
+    teamsTier: int(f, 1),
+    planName: sub(f, 2)?.toString("utf8").trim() ?? "",
+    monthlyFlowCredits: int(f, 13),
+    billingStrategy: int(f, 35),
+    hideDailyQuota: int(f, 36) === 1,
+    hideWeeklyQuota: int(f, 37) === 1,
+  };
+}
+
+/** Null when the response carries no PlanStatus, which is not something a mapper can use. */
+export function decodeDevinUserStatus(buf: Buffer): DevinUserStatus | null {
+  const response = fieldsOf(buf, RESPONSE_WIRES);
+  const user = response && fieldsOf(sub(response, 1), USER_WIRES);
+  const statusBuf = user && sub(user, 13);
+  if (!statusBuf) return null;
+  const status = fieldsOf(statusBuf, STATUS_WIRES);
+  if (!status) return null;
+  // The top-level PlanInfo is authoritative; the nested copy covers servers that omit it.
+  const plan = decodePlanInfo(sub(response, 2) ?? sub(status, 1));
+  if (!plan) return null;
+  if (!plan.teamsTier) plan.teamsTier = int(user, 10);
+  const planEndMs = timestampMs(sub(status, 3));
+  if (planEndMs === null) return null;
+  const dailyResetMs = epochMillis(int(status, 17));
+  const weeklyResetMs = epochMillis(int(status, 18));
+  return {
+    plan,
+    ...(planEndMs !== undefined ? { planEndMs } : {}),
+    usedPromptCredits: int(status, 6),
+    availablePromptCredits: int(status, 8),
+    usedFlowCredits: int(status, 5),
+    availableFlowCredits: int(status, 9),
+    usedFlexCredits: int(status, 7),
+    availableFlexCredits: int(status, 4),
+    dailyRemainingPercent: int(status, 14),
+    weeklyRemainingPercent: int(status, 15),
+    ...(dailyResetMs !== undefined ? { dailyResetMs } : {}),
+    ...(weeklyResetMs !== undefined ? { weeklyResetMs } : {}),
+    overageBalanceMicros: int(status, 16),
+    // proto3 omits a zero balance, so an exhausted pool arrives as `used` alone. Only a
+    // status with no balance field at all carries no credit evidence.
+    promptCreditBalancePresent: [4, 6, 7, 8].some((field) => status.has(field)),
+  };
+}
+
+function usedPercent(used: number, available: number): number | undefined {
+  // A negative balance is the unlimited sentinel; nothing to measure against.
+  if (available < 0 || used < 0 || used + available <= 0) return undefined;
+  return Math.min(100, (used / (used + available)) * 100);
+}
+
+function remainingToUsed(remaining: number): number {
+  return 100 - Math.max(0, Math.min(100, remaining));
+}
+
+/**
+ * Only DATED percent windows whose reset is still ahead are published. A credit-billed plan
+ * leaves the percent fields at their zero default, and a reset already in the past describes
+ * a window that has rolled over; either would read as a fully spent window and mark the
+ * account exhausted for routing.
+ *
+ * The credit pool is published only for a credit-billed plan, or for an unknown strategy
+ * with both reset fields absent. Expired dated windows still identify a quota plan.
+ * A quota-billed plan still reports credit balances, and a zero balance there does not
+ * gate anything.
+ *
+ * Flow credits are decoded but not published. They meter agent tool actions, not chat
+ * turns, and account ranking reads the fullest custom window as the account's limit, so an
+ * empty flow balance would retire an account that can still serve chat.
+ *
+ * Credits are measured against the server's own balance rather than the plan grant, so
+ * top-ups count. Flex credits back prompt credits once those run out, so both share one
+ * pool: an account with prompt credits spent and flex remaining can still serve.
+ */
+export function devinQuotaFromStatus(status: DevinUserStatus, now = Date.now()): ProviderQuota {
+  const quota: ProviderQuota = { updatedAt: now };
+  const customWindows: ProviderQuotaWindow[] = [];
+  const ahead = (resetMs: number | undefined): resetMs is number => resetMs !== undefined && resetMs > now;
+  if (!status.plan.hideDailyQuota && ahead(status.dailyResetMs)) {
+    customWindows.push({ label: "Daily", percent: remainingToUsed(status.dailyRemainingPercent), resetAt: status.dailyResetMs });
+  }
+  if (!status.plan.hideWeeklyQuota && ahead(status.weeklyResetMs)) {
+    quota.weeklyPercent = remainingToUsed(status.weeklyRemainingPercent);
+    quota.weeklyResetAt = status.weeklyResetMs;
+  }
+  const strategy = status.plan.billingStrategy;
+  const creditBilled = strategy === BILLING_STRATEGY_CREDITS
+    || (strategy === 0 && status.dailyResetMs === undefined && status.weeklyResetMs === undefined);
+  const available = status.availablePromptCredits + status.availableFlexCredits;
+  const credits = !creditBilled || !status.promptCreditBalancePresent
+    || status.availablePromptCredits < 0 || status.availableFlexCredits < 0
+    || status.usedPromptCredits < 0 || status.usedFlexCredits < 0
+    ? undefined
+    // A credit-billed plan with nothing used and nothing left has no balance to serve from;
+    // leaving it unmeasured would rank it as untested headroom.
+    : available === 0 ? 100
+    : usedPercent(status.usedPromptCredits + status.usedFlexCredits, available);
+  if (credits !== undefined) {
+    quota.monthlyPercent = credits;
+    if (status.planEndMs !== undefined) quota.monthlyResetAt = status.planEndMs;
+  }
+  if (customWindows.length > 0) quota.customWindows = customWindows;
+  return quota;
+}
+
+/**
+ * Probe one Devin account. `null` keeps the last-good row (transient failure);
+ * `TERMINAL_QUOTA_FAILURE` means the credential or contract is rejected.
+ */
+export async function fetchDevinQuota(provider: string, apiKey: string, apiBaseUrl: string | undefined, configuredBaseUrl?: string): Promise<ProviderQuotaProbeResult> {
+  const base = validateDevinApiBaseUrl(apiBaseUrl)
+    ?? (configuredBaseUrl !== undefined || apiBaseUrl === undefined ? resolveDevinApiBaseUrl(configuredBaseUrl) : undefined);
+  if (!base || !apiKey.trim()) return null;
+  const metadata = buildMetadata({
+    apiKey,
+    sessionId: crypto.randomUUID(),
+    requestId: BigInt(Date.now()),
+    triggerId: crypto.randomUUID(),
+  });
+  try {
+    const deadline = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+    const response = await fetch(`${base}${GET_USER_STATUS_PATH}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/proto", "Connect-Protocol-Version": "1" },
+      // GetUserStatusRequest { #1 metadata }
+      body: new Uint8Array(encodeMessage(1, metadata)),
+      // The body carries the api_key; a redirect would replay it at another host.
+      redirect: "error",
+      signal: deadline,
+    });
+    if (!response.ok) {
+      void response.body?.cancel().catch(() => undefined);
+      // Only 401 proves the key itself is refused. A 403 can scope this one RPC away from a
+      // key that still serves chat, so it keeps the last-good reading like other failures.
+      return response.status === 401 ? TERMINAL_QUOTA_FAILURE : null;
+    }
+    const body = await readBoundedResponseBytes(response, {
+      signal: deadline,
+      maxBytes: QUOTA_RESPONSE_MAX_BYTES,
+      inactivityTimeoutMs: REQUEST_TIMEOUT_MS,
+    });
+    if (body.oversized) return null;
+    // Inside the try: a truncated varint throws, and a malformed body must keep last-good.
+    const status = decodeDevinUserStatus(Buffer.from(body.bytes.buffer, body.bytes.byteOffset, body.bytes.byteLength));
+    if (!status) return null;
+    // A decoded status with nothing measurable (an unlimited plan, hidden windows) is an
+    // authoritative answer, not a failed probe, so it must replace any last-good row.
+    return report(provider, "devin:user-status", devinQuotaFromStatus(status)) ?? AUTHORITATIVE_EMPTY_QUOTA;
+  } catch {
+    return null;
+  }
+}

package/src/providers/quota/vendor-probes-oauth.ts

@@ -18,6 +18,7 @@ import { aggregateCodexPoolCapacity, CODEX_CAPACITY_MAX_QUOTA_AGE_MS, type Codex
 import { asRecord, normalizePercent, normalizeResetAt, readQuotaJson, REQUEST_TIMEOUT_MS, toFiniteNumber } from "../quota-wire";
 import { providerCodexAccountMode } from "../registry";
 import {
+  TERMINAL_QUOTA_FAILURE,
   hasQuotaRows,
   providerLabel,
   providerQuotaFromCodexQuota,
@@ -25,6 +26,7 @@ import {
   report,
   tagNativeMainReport,
   type CodexAuthAccountsSnapshotPromise,
+  type ProviderQuotaProbeResult,
   type ProviderQuotaReport,
 } from "./report-cache";
 import {
@@ -46,9 +48,11 @@ export async function fetchChatGptForwardQuota(
   providerConfig: OcxProviderConfig,
   forceRefresh: boolean,
   prefetchedSnapshot?: CodexAuthAccountsSnapshotPromise,
-): Promise<ProviderQuotaReport | null> {
+): Promise<ProviderQuotaProbeResult> {
   if (providerCodexAccountMode(provider, providerConfig) === "direct") {
-    const snapshot = await fetchMainAccountInfoSnapshot(forceRefresh);
+    const snapshot = await fetchMainAccountInfoSnapshot(forceRefresh, config);
+    // A parsed return from a replaced credential cannot retain an older cached report either.
+    if (snapshot.infoUnpublished) return TERMINAL_QUOTA_FAILURE;
     const quota = providerQuotaFromCodexQuota(snapshot.info.quota);
     if (quota) quota.updatedAt = Date.now();
     return quota

package/src/providers/quota.ts

@@ -1,4 +1,3 @@
-
 import { listCodexAuthAccountsSnapshot } from "../codex/auth-api";
 import { resolveEnvValue } from "../config";
 import { getAccountCredential, getAccountSet } from "../oauth/store";
@@ -363,6 +362,7 @@ async function readExplicitAccountQuota(provider: string, accountId: string, con
     case "cursor": result = await fetchCursorQuota(provider, accessToken); break;
     case "kimi": result = await fetchKimiQuota(provider, config, accessToken); break;
     case "command-code": result = await fetchCommandCodeQuota(provider, config, accessToken); break;
+    case "devin": result = await (await import("./quota/devin")).fetchDevinQuota(provider, accessToken, credential.apiBaseUrl, config.baseUrl); break;
     default: return null;
   }
   return { result, identity, isCurrent };

package/src/providers/registry/entries-core.ts

@@ -190,7 +190,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // (it is the current catalog, so its default ordering wins), then the ids
     // only the old devin entry carried. Degraded-mode seed only either way —
     // `liveModels` discovers the account's real roster.
-    models: ["swe-2", "swe-1-7", "gpt-5-6-sol", "gpt-6-astra", "gpt-6-sol", "gpt-6-luna", "claude-opus-5-5", "claude-opus-5", "claude-fable-5-1", "claude-sonnet-5", "glm-5-3", "kimi-k3", "gemini-3-8-flash", "grok-4-6", "grok-4-7", "swe-1-7-lightning", "gpt-5-6-luna", "gpt-5-6-terra", "claude-opus-4-8", "glm-5-2", "kimi-k2-7", "grok-4-5"],
+    models: ["swe-2", "swe-1-7", "gpt-5-6-sol", "gpt-6-astra", "gpt-6-sol", "gpt-6-luna", "claude-opus-5-5", "claude-opus-5", "claude-fable-5-1", "claude-sonnet-5-5", "claude-sonnet-5", "glm-5-3", "kimi-k3", "gemini-3-8-flash", "grok-4-6", "grok-4-7", "swe-1-7-lightning", "gpt-5-6-luna", "gpt-5-6-terra", "claude-opus-4-8", "glm-5-2", "kimi-k2-7", "grok-4-5"],
     liveModels: true,
     defaultModel: "swe-2",
     modelContextWindows: DEVIN_MODEL_CONTEXT_WINDOWS,