@buyong/pi-devin 0.1.5 → 0.1.6

package/README.ko.md

@@ -73,12 +73,11 @@ TUI에서 `/devin`을 실행하면 다음을 한 화면에 보여 줍니다. ↑
 
 - 계정 사용량 한도: 일간·주간 남은 비율 막대, 재설정 시각, 데이터를 가져온 시각
 - 이 세션의 사용량: 요청 수와 입력·출력·캐시 토큰. 보조 모델 대화는 포함하지 않습니다.
-- 실행 예산: 현재(또는 마지막) 사용자 메시지가 지금까지 쓴 모델 요청 수를 메시지당 한도에 대한 막대로 표시([제한과 동작](#제한과-동작) 참고)
 
 설정 두 개가 있으며 둘 다 기본값은 꺼짐입니다. 바꾸면 모든 세션에 한 번에 적용됩니다.
 
 - **Recommended models only**: `/model`에 Devin이 Recommended로 표시한 변형이 있는 모델과 Devin Fusion만 보여 줍니다. Devin은 `swe-2-high` 같은 개별 변형을 표시하지만, 목록에는 모델 자체(`swe-2`)가 남으므로 추론 수준은 계속 `/thinking`으로 고릅니다. 권장 수준이 자동으로 적용되지는 않습니다. 계정에 권장 모델이 없으면 전체 목록을 보여 줍니다.
-- **Usage in status line**: TUI 하단에 남은 일간·주간 사용량 막대와 이 세션의 입력·출력 토큰을 `devin day ▕█████████░▏98% week ▕█████████░▏98% · ↑263 ↓49`처럼 표시합니다. 막대는 40% 이하에서 경고 색, 20% 이하에서 오류 색으로 바뀝니다.
+- **Usage in status line**: TUI 하단에 남은 일간·주간 사용량 막대와 이 세션의 입력·출력 토큰을 `devin day ▕█████████░▏98% week ▕█████████░▏98% · ↑263 ↓49`처럼 표시합니다. 막대는 40% 이하에서 경고 색, 20% 이하에서 오류 색으로 바뀝니다. Devin Fusion을 포함해 Devin 모델을 선택했을 때만 보이고, 다른 공급자의 모델로 바꾸면 사라집니다. `/devin`은 어떤 모델을 선택했든 사용량을 보여 줍니다.
 
 사용량 한도는 실시간이 아닙니다. 로그인할 때와 각 모델 요청 직전의 계정 확인에서 갱신되며, 같은 Pi agent 디렉터리를 쓰는 서브에이전트와 Fusion 보조 모델의 요청도 여기에 포함됩니다. 따라서 방금 보낸 메시지의 사용량은 다음 요청 뒤에 반영됩니다. `/devin`과 상태 표시줄은 네트워크 요청을 보내지 않으며, 상태 표시줄은 다른 Pi 프로세스가 기록한 값을 턴이 끝날 때마다 반영합니다. 크레딧, 요청별 비용, 사용 기록은 표시하지 않습니다.
 
@@ -105,10 +104,9 @@ RPC 모드처럼 TUI가 아닌 환경에서는 `/devin recommended on|off`와 `/
 
 | 항목 | 동작 |
 | --- | --- |
-| 모델 요청 예산 | 사용자 메시지 하나를 처리하는 동안 도구 후속 요청, 재시도, 자동 압축을 포함해 기본 최대 8번 모델을 호출합니다. 보조 모델 작업마다 같은 한도를 따로 받습니다. `PI_DEVIN_MAX_MODEL_CALLS`(1–100)로 바꿉니다. |
-| 요청 제한 시간 | Pi가 설정한 값을 따릅니다(기본 300초). |
+| 요청 제한 시간 | Pi가 설정한 값을 따릅니다(기본 300초). 응답이 계속 들어오는 동안에는 끊지 않고, 그 시간 동안 데이터가 오지 않을 때만 실패합니다. |
 | 프롬프트 캐시 | 기본은 짧은 캐시입니다. `PI_CACHE_RETENTION=long`은 Devin이 24시간 캐시로 표시한 모델에만 허용하며, 다른 모델에서는 요청을 보내기 전에 거부합니다. |
-| 이미지 | 지원하는 모델에서 이미지당 최대 4 MiB, 메시지당 합계 최대 5 MiB입니다. |
+| 이미지 | 지원하는 모델에서 이미지당 최대 4 MiB, 메시지당 합계 최대 5 MiB입니다. 이미지를 지원하지 않는 모델로 바꾸면 이전 이미지는 생략했다는 안내 문구로 바뀝니다. |
 | 보조 모델 보고 | 주 모델은 보고마다 상태·오류·안내를 포함해 최대 약 131,072토큰(524,288자, Pi의 문맥 추정처럼 4자를 1토큰으로 계산)을 받습니다. 더 긴 보고는 잘리고, 끝에 전체 보고가 담긴 임시 파일 경로가 붙습니다([저장 위치](#저장-위치) 참고). 저장에 실패하면 잘린 보고에 안내를 대신 붙입니다. |
 | print·JSON 모드 | 이 모드는 모델 목록을 가져오지 않고, 이전 TUI나 RPC 세션이 저장한 목록을 씁니다. 로그인한 상태로 TUI나 RPC 모드를 한 번 이상 실행해 목록을 저장해야 하며, 그러지 않으면 `--model devin/<모델 ID>`를 찾지 못합니다. |
 

package/README.md

@@ -71,12 +71,11 @@ Running `/devin` in the TUI shows the following on one screen. Use ↑↓ to mov
 
 - Account quota: daily and weekly remaining-percentage bars, reset times and when the data was fetched
 - Usage in this session: request count and input, output and cache tokens. Sidekick conversations are not included.
-- Run budget: a bar of the model requests used so far by the current (or last) user message, out of the per-message limit (see [Limits and behavior](#limits-and-behavior))
 
 There are two toggles, both off by default. Changes apply to all sessions at once.
 
 - **Recommended models only**: `/model` shows only the models that have a variant Devin marks as Recommended, plus Devin Fusion. Devin marks single variants such as `swe-2-high`, but the list keeps the model itself (`swe-2`), so you still pick the thinking level with `/thinking`. The recommended level is not applied automatically. If your account has no recommended models, the full list is shown.
-- **Usage in status line**: the TUI footer shows the remaining daily and weekly quota as bars, plus this session's input and output tokens, like `devin day ▕█████████░▏98% week ▕█████████░▏98% · ↑263 ↓49`. A bar turns to the warning color at 40% or less and to the error color at 20% or less.
+- **Usage in status line**: the TUI footer shows the remaining daily and weekly quota as bars, plus this session's input and output tokens, like `devin day ▕█████████░▏98% week ▕█████████░▏98% · ↑263 ↓49`. A bar turns to the warning color at 40% or less and to the error color at 20% or less. It appears only while a Devin model, including Devin Fusion, is selected, and disappears when you switch to another provider's model. `/devin` shows usage whichever model is selected.
 
 Quota is not live. It is refreshed when you log in and by the account check right before each model request, including requests from subagents and the Fusion sidekick that use the same Pi agent directory, so the usage of the message you just sent shows up after the next request. `/devin` and the status line send no network requests; the status line picks up quota recorded by other Pi processes at the end of each turn. Credits, per-request costs and usage history are not shown.
 
@@ -103,10 +102,9 @@ Picking **Devin Fusion** (`fusion`) in `/model` turns on the `devin_sidekick` to
 
 | Item | Behavior |
 | --- | --- |
-| Model request budget | Processing one user message calls models up to 8 times by default, including tool follow-ups, retries and auto-compaction. Each sidekick task gets the same limit separately. Change it with `PI_DEVIN_MAX_MODEL_CALLS` (1–100). |
-| Request timeout | Follows the value set by Pi (300 seconds by default). |
+| Request timeout | Follows the value set by Pi (300 seconds by default). A response that keeps arriving is not cut off; the request fails only when no data arrives for that long. |
 | Prompt cache | Short cache by default. `PI_CACHE_RETENTION=long` is allowed only for models Devin marks with a 24-hour cache; for other models the request is refused before sending. |
-| Images | On supported models, up to 4 MiB per image and 5 MiB in total per message. |
+| Images | On supported models, up to 4 MiB per image and 5 MiB in total per message. After switching to a model without image support, earlier images are replaced with a note saying they were left out. |
 | Sidekick report | The lead receives at most about 131,072 tokens of each report (524,288 characters, counted like Pi's context estimate of 4 characters per token), including status, errors and notices. A longer report is cut and ends with the path of a temporary file that holds the complete report (see [Storage locations](#storage-locations)). If saving fails, the cut report includes a notice instead. |
 | print and JSON modes | These modes do not fetch the model list; they use the list stored by an earlier TUI or RPC session. Run the TUI or RPC mode at least once while logged in so the list is stored; otherwise `--model devin/<model ID>` is not found. |
 

package/index.ts

@@ -1,19 +1,10 @@
-import { getAgentDir, type ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { devinSettingsPath, fileDevinSettings } from "./src/pi/devin-settings.ts";
-import { registerDevinExtension } from "./src/pi/extension.ts";
-import { fileFusionSettings, fusionSettingsPath } from "./src/pi/fusion-settings.ts";
-import { modelCallLimit } from "./src/pi/lifecycle.ts";
-import { FUSION_CHILD_ENV } from "./src/pi/sidekick.ts";
-import { accountUsagePath, fileAccountUsageStore } from "./src/pi/usage-store.ts";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { registerDevinExtension } from "./src/pi/adapters/pi/registration.ts";
+import { productionEnvironment } from "./src/pi/app/environment.ts";
+import { FUSION_CHILD_ENV } from "./src/pi/features/sidekick/prompts.ts";
 
+/** Pi's entry point. */
 export default function devinExtension(pi: ExtensionAPI): void {
   const isFusionChild = process.env[FUSION_CHILD_ENV] === "1";
-  registerDevinExtension(pi, {
-    maxModelCalls: modelCallLimit(process.env.PI_DEVIN_MAX_MODEL_CALLS),
-    isFusionChild,
-    // The sidekick child records its quota too, so the lead's status shows what the sidekick used.
-    accountUsage: fileAccountUsageStore(accountUsagePath(getAgentDir())),
-    fusionSettings: isFusionChild ? undefined : fileFusionSettings(fusionSettingsPath(getAgentDir())),
-    devinSettings: isFusionChild ? undefined : fileDevinSettings(devinSettingsPath(getAgentDir())),
-  });
+  registerDevinExtension(pi, productionEnvironment({ isFusionChild }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buyong/pi-devin",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "type": "module",
   "description": "Unofficial Pi provider for Devin accounts (OAuth)",
   "license": "MIT",
@@ -41,6 +41,8 @@
     "themes": []
   },
   "dependencies": {
+    "@effect/platform-node": "4.0.5",
+    "effect": "4.0.5",
     "protobufjs": "8.8.1"
   },
   "peerDependencies": {

package/src/core/auth/access.ts

@@ -1,6 +1,10 @@
+import { Effect } from "effect";
+import type { DevinError } from "../errors.ts";
 import type { JsonObject } from "../types.ts";
+import { failWith } from "../validation.ts";
 
-export function assertCanInfer(status: JsonObject): void {
-  if (status.canUseCli !== true) throw new Error("Could not confirm that this account may use the CLI.");
-  if (status.dailyQuotaRemainingPercent === 0 || status.weeklyQuotaRemainingPercent === 0) throw new Error("The reported quota is 0, so no inference is run.");
+export function assertCanInfer(status: JsonObject): Effect.Effect<void, DevinError> {
+  if (status.canUseCli !== true) return failWith("Could not confirm that this account may use the CLI.");
+  if (status.dailyQuotaRemainingPercent === 0 || status.weeklyQuotaRemainingPercent === 0) return failWith("The reported quota is 0, so no inference is run.");
+  return Effect.void;
 }

package/src/core/auth/callback-server.ts

@@ -0,0 +1,57 @@
+import { createServer } from "node:http";
+import { Effect, type Scope } from "effect";
+import { HttpServerRequest, HttpServerResponse } from "effect/http";
+// A subpath import: the package index also loads NodeRedis, whose `redis` peer Pi's installer does not install.
+import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
+import { toDevinError, type DevinError } from "../errors.ts";
+import { failWith } from "../validation.ts";
+import { matchesState } from "./pkce.ts";
+
+export interface CallbackHandlers {
+  state: string;
+  /** A code was accepted or the login was denied, so every later callback is refused. */
+  isSettled(): boolean;
+  /** Accepts a valid code once and reports whether it was taken. */
+  accept(code: string): boolean;
+  deny(): void;
+}
+
+const SECURITY_HEADERS = {
+  "cache-control": "no-store",
+  "content-security-policy": "default-src 'none'; frame-ancestors 'none'",
+  "referrer-policy": "no-referrer",
+};
+
+const respond = (status: number, body: string) => HttpServerResponse.text(body, { status, headers: SECURITY_HEADERS, contentType: "text/plain; charset=utf-8" });
+
+function callback(handlers: CallbackHandlers): Effect.Effect<HttpServerResponse.HttpServerResponse, never, HttpServerRequest.HttpServerRequest> {
+  return Effect.gen(function* () {
+    const request = yield* HttpServerRequest.HttpServerRequest;
+    let url: URL;
+    try { url = new URL(request.url, "http://127.0.0.1"); } catch { return respond(400, "Invalid callback URL"); }
+    if (request.method !== "GET" || url.pathname !== "/callback") return respond(404, "Not found");
+    if (handlers.isSettled() || !matchesState(url.searchParams.get("state"), handlers.state)) return respond(400, "Invalid OAuth state");
+    if (url.searchParams.has("error")) {
+      handlers.deny();
+      return respond(400, "Login was denied.");
+    }
+    if (!handlers.accept(url.searchParams.get("code") ?? "")) return respond(400, "Missing authorization code");
+    return respond(200, "Authorization code received. Check the token exchange result in your terminal.");
+  });
+}
+
+/** Serves the OAuth callback on a loopback port for the scope's lifetime and returns its redirect URL. Closing drops open connections at once. */
+export function startCallbackServer(handlers: CallbackHandlers): Effect.Effect<string, DevinError, Scope.Scope> {
+  return Effect.gen(function* () {
+    const server = createServer();
+    const httpServer = yield* NodeHttpServer.make(() => server, { port: 0, host: "127.0.0.1", disablePreemptiveShutdown: true }).pipe(
+      Effect.mapError((error) => toDevinError(error.cause ?? error)),
+    );
+    // Runs before the server's own shutdown, which would otherwise wait for idle keep-alive connections.
+    yield* Effect.addFinalizer(() => Effect.sync(() => server.closeAllConnections()));
+    yield* httpServer.serve(callback(handlers));
+    const address = server.address();
+    if (!address || typeof address === "string") return yield* failWith("Could not determine the callback port.");
+    return `http://127.0.0.1:${address.port}/callback`;
+  });
+}

package/src/core/auth/index.ts

@@ -1,2 +1,3 @@
-export { login, loginAccount, createPKCE, DEFAULT_API_SERVER_URL, DEFAULT_WEBAPP_URL, DEFAULT_DEVIN_API_URL } from "./login.ts";
+export { login, loginAccount, DEFAULT_API_SERVER_URL, DEFAULT_WEBAPP_URL, DEFAULT_DEVIN_API_URL } from "./login.ts";
 export type { LoginOptions, LoginFlow } from "./login.ts";
+export { createPKCE } from "./pkce.ts";

package/src/core/auth/login.ts

@@ -1,7 +1,15 @@
-import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import { createServer } from "node:http";
-import { awaitWithSignal, ConnectClient, endpoint, RPCError, safeError } from "../protocol/transport.ts";
-import { requiredString, type Credential } from "../types.ts";
+import { randomUUID } from "node:crypto";
+import { Deferred, Effect, Exit, Fiber, Predicate } from "effect";
+import { startDeadline } from "../cancellation.ts";
+import { DevinError, RequestTimeout, toDevinError, type DevinFailure } from "../errors.ts";
+import { makeConnectClient } from "../protocol/connect-client.ts";
+import { endpoint } from "../protocol/endpoint.ts";
+import { redactFailure } from "../redaction.ts";
+import type { HttpTransport } from "../services/http-transport.ts";
+import type { Credential } from "../types.ts";
+import { failWith, requiredString } from "../validation.ts";
+import { startCallbackServer } from "./callback-server.ts";
+import { codeForExchange, createPKCE, isAuthorizationCode, matchesState, PKCE_CODE_PREFIX } from "./pkce.ts";
 import { exchangeBrowserCode } from "./rest-exchange.ts";
 
 export const DEFAULT_API_SERVER_URL = "https://server.codeium.com";
@@ -9,169 +17,114 @@ export const DEFAULT_WEBAPP_URL = "https://app.devin.ai";
 export const DEFAULT_DEVIN_API_URL = "https://api.devin.ai";
 const EXCHANGE_METHOD = "exa.seat_management_pb.SeatManagementService/ExchangeDevinCLIPKCECode";
 const PKCE_EXCHANGE_METHOD = "exa.seat_management_pb.SeatManagementService/ExchangePKCEAuthorizationCode";
-const PKCE_CODE_PREFIX = "wspkce$";
-const codeForExchange = (code: string) => code.startsWith(PKCE_CODE_PREFIX) ? code.slice(PKCE_CODE_PREFIX.length) : code;
+const LOGIN_TIMEOUT_MS = 300_000;
+const CONNECT_EXCHANGE_TIMEOUT_MS = 30_000;
+
 export type LoginFlow = "browser" | "manual" | "legacy-connect";
 export interface LoginOptions {
   apiServerURL?: string;
   webappURL?: string;
   devinAPIURL?: string;
   timeoutMs?: number;
-  signal?: AbortSignal;
-  onURL: (url: string, signal: AbortSignal) => void | Promise<void>;
-  /** Receives a one-time authorization code, never an API key or session token. */
-  promptCode?: (signal: AbortSignal) => Promise<string>;
-  fetch?: typeof fetch;
+  /** Shows or opens the authorization URL. */
+  onURL: (url: string) => Effect.Effect<void, DevinFailure>;
+  /** Reads a one-time authorization code, never an API key or session token. Interrupted as soon as the browser callback wins. */
+  promptCode?: Effect.Effect<string, DevinFailure>;
   encoding?: "proto" | "json";
   flow?: LoginFlow;
 }
 
-export function createPKCE(): { verifier: string; challenge: string; state: string } {
-  const verifier = randomBytes(32).toString("base64url");
-  return {
-    verifier,
-    challenge: createHash("sha256").update(verifier).digest("base64url"),
-    state: randomBytes(32).toString("base64url"),
-  };
-}
-
-function matchesState(received: string | null, expected: string): boolean {
-  if (!received) return false;
-  const left = Buffer.from(received), right = Buffer.from(expected);
-  return left.length === right.length && timingSafeEqual(left, right);
+/** The new account UI defaults to the REST browser flow. An explicit encoding keeps the legacy Connect path. Code exchanges go through `HttpTransport`. */
+export function loginAccount(options: LoginOptions): Effect.Effect<Credential, DevinFailure, HttpTransport> {
+  return login({ ...options, flow: options.flow ?? (options.encoding === undefined ? "browser" : "legacy-connect") });
 }
 
-function isAuthorizationCode(code: string): boolean {
-  return code.length > 0 && code.length <= 8192 && codeForExchange(code).length > 0
-    && !/[\s\u0000-\u001f\u007f]/.test(code)
-    && !/^(devin-session-token\$|cog_|sk-ws-01-|Bearer |Basic )/.test(code);
+function validate(options: LoginOptions, flow: LoginFlow): Effect.Effect<void, DevinError> {
+  if (!["browser", "manual", "legacy-connect"].includes(flow)) return failWith("Unsupported login flow.");
+  if (options.encoding !== undefined && options.encoding !== "proto" && options.encoding !== "json") return failWith("The login encoding must be proto or json.");
+  if (flow === "browser" && options.encoding !== undefined) return failWith("A Connect encoding cannot be used with the REST browser login.");
+  if (flow !== "browser" && options.devinAPIURL !== undefined) return failWith("The Devin REST login server can only be set for the REST browser flow.");
+  if (flow === "manual" && !options.promptCode) return failWith("Manual login requires an authorization code prompt.");
+  return Effect.void;
 }
 
-/** The new account UI defaults to the REST browser flow. An explicit encoding keeps the legacy Connect path. */
-export function loginAccount(options: LoginOptions): Promise<Credential> {
-  return login({ ...options, flow: options.flow ?? (options.encoding === undefined ? "browser" : "legacy-connect") });
+function connectExchange(apiServerURL: string, code: string, verifier: string, options: LoginOptions): Effect.Effect<string, DevinFailure, HttpTransport> {
+  return Effect.scoped(Effect.gen(function* () {
+    const client = yield* makeConnectClient({ baseURL: apiServerURL, timeoutMs: CONNECT_EXCHANGE_TIMEOUT_MS });
+    const isWindsurfCode = code.startsWith(PKCE_CODE_PREFIX);
+    const method = isWindsurfCode ? PKCE_EXCHANGE_METHOD : EXCHANGE_METHOD;
+    const body = isWindsurfCode ? { authorizationCode: codeForExchange(code), codeVerifier: verifier } : { code, codeVerifier: verifier };
+    const exchanged = yield* client.unary(method, body, { encoding: options.encoding ?? "proto" });
+    if (isWindsurfCode && Predicate.isString(exchanged.apiServerUrl) && exchanged.apiServerUrl && (yield* endpoint(exchanged.apiServerUrl)) !== apiServerURL) {
+      return yield* failWith("The login returned a different API server. Set the target with --api-server-url and sign in again.");
+    }
+    const tokenField = isWindsurfCode ? "apiKey" : "sessionToken";
+    return yield* requiredString(exchanged[tokenField], `${method}.${tokenField}`);
+  }));
 }
 
 /** Keeps the default Connect contract of the existing shared login(). Storage and opening the browser belong to the caller. */
-export async function login(options: LoginOptions): Promise<Credential> {
-  const flow = options.flow ?? "legacy-connect";
-  if (!["browser", "manual", "legacy-connect"].includes(flow)) throw new Error("Unsupported login flow.");
-  if (options.encoding !== undefined && options.encoding !== "proto" && options.encoding !== "json") throw new Error("The login encoding must be proto or json.");
-  if (flow === "browser" && options.encoding !== undefined) throw new Error("A Connect encoding cannot be used with the REST browser login.");
-  if (flow !== "browser" && options.devinAPIURL !== undefined) throw new Error("The Devin REST login server can only be set for the REST browser flow.");
-  if (flow === "manual" && !options.promptCode) throw new Error("Manual login requires an authorization code prompt.");
-  const apiServerURL = endpoint(options.apiServerURL ?? DEFAULT_API_SERVER_URL);
-  const webappURL = endpoint(options.webappURL ?? DEFAULT_WEBAPP_URL);
-  const devinAPIURL = endpoint(options.devinAPIURL ?? DEFAULT_DEVIN_API_URL);
-  const signal = AbortSignal.any([...(options.signal ? [options.signal] : []), AbortSignal.timeout(options.timeoutMs ?? 300_000)]);
-  signal.throwIfAborted();
-  const pkce = createPKCE();
-  if (flow !== "legacy-connect") pkce.state = randomUUID();
-  let resolveCode!: (code: string) => void, rejectCode!: (error: Error) => void;
-  let hasAcceptedCode = false, authorizationCode = "";
-  let client: ConnectClient | undefined;
-  let redirectURL: string | undefined;
-  const inputController = new AbortController();
-  const inputSignal = AbortSignal.any([signal, inputController.signal]);
-  const codePromise = new Promise<string>((resolve, reject) => { resolveCode = resolve; rejectCode = reject; });
-  void codePromise.catch(() => {});
-  const acceptCode = (code: string) => {
-    if (hasAcceptedCode || !isAuthorizationCode(code)) return false;
-    hasAcceptedCode = true;
-    authorizationCode = code;
-    resolveCode(code);
-    inputController.abort(new DOMException("Authorization code received.", "AbortError"));
-    return true;
-  };
-  const server = createServer((request, response) => {
-    response.setHeader("Content-Type", "text/plain; charset=utf-8");
-    response.setHeader("Cache-Control", "no-store");
-    response.setHeader("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'");
-    response.setHeader("Referrer-Policy", "no-referrer");
-    let url: URL;
-    try { url = new URL(request.url ?? "/", "http://127.0.0.1"); }
-    catch { response.writeHead(400).end("Invalid callback URL"); return; }
-    if (request.method !== "GET" || url.pathname !== "/callback") { response.writeHead(404).end("Not found"); return; }
-    if (hasAcceptedCode || !matchesState(url.searchParams.get("state"), pkce.state)) { response.writeHead(400).end("Invalid OAuth state"); return; }
-    if (url.searchParams.has("error")) {
-      hasAcceptedCode = true;
-      response.writeHead(400).end("Login was denied.");
-      rejectCode(new Error("OAuth login was denied."));
-      inputController.abort();
-      return;
-    }
-    if (!acceptCode(url.searchParams.get("code") ?? "")) { response.writeHead(400).end("Missing authorization code"); return; }
-    response.end("Authorization code received. Check the token exchange result in your terminal.");
-  });
-  const onAbort = () => rejectCode(new DOMException(
-    signal.reason?.name === "TimeoutError" ? "OAuth login timed out." : "OAuth login was cancelled.",
-    signal.reason?.name === "TimeoutError" ? "TimeoutError" : "AbortError",
-  ));
-  signal.addEventListener("abort", onAbort, { once: true });
-  try {
-    if (flow !== "manual") {
-      await new Promise<void>((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(0, "127.0.0.1", () => { server.off("error", reject); resolve(); });
-      });
-      const address = server.address();
-      if (!address || typeof address === "string") throw new Error("Could not determine the callback port.");
-      redirectURL = `http://127.0.0.1:${address.port}/callback`;
-    }
-    const authorizationURL = new URL(flow === "manual" ? "/devin/account/login" : "/auth/cli/continue", webappURL);
-    authorizationURL.search = new URLSearchParams({
-      redirect_uri: flow === "manual" ? "chisel-show-auth-token" : redirectURL!,
-      state: pkce.state,
-      ...(flow === "manual" ? {} : { prompt: "select_account" }),
-      code_challenge: pkce.challenge, code_challenge_method: "S256",
-    }).toString();
-    signal.throwIfAborted();
-    await awaitWithSignal(Promise.resolve(options.onURL(authorizationURL.href, signal)), signal);
-    if (options.promptCode && !hasAcceptedCode) {
-      void awaitWithSignal(Promise.resolve().then(() => options.promptCode!(inputSignal)), inputSignal).then((value) => {
-        if (hasAcceptedCode || signal.aborted) return;
-        authorizationCode = value.trim(); // Also keeps the raw code out of errors.
-        let code = authorizationCode;
-        if (/^https?:\/\//.test(code)) {
-          const pasted = new URL(code);
-          if (!redirectURL || pasted.origin + pasted.pathname !== redirectURL || !matchesState(pasted.searchParams.get("state"), pkce.state)) {
-            throw new Error("The pasted callback URL or state does not match.");
+export function login(options: LoginOptions): Effect.Effect<Credential, DevinFailure, HttpTransport> {
+  return Effect.gen(function* () {
+    const flow = options.flow ?? "legacy-connect";
+    yield* validate(options, flow);
+    const apiServerURL = yield* endpoint(options.apiServerURL ?? DEFAULT_API_SERVER_URL);
+    const webappURL = yield* endpoint(options.webappURL ?? DEFAULT_WEBAPP_URL);
+    const devinAPIURL = yield* endpoint(options.devinAPIURL ?? DEFAULT_DEVIN_API_URL);
+    const pkce = createPKCE();
+    if (flow !== "legacy-connect") pkce.state = randomUUID();
+    let authorizationCode = "";
+    const secrets = () => [authorizationCode, codeForExchange(authorizationCode), pkce.verifier];
+
+    return yield* Effect.scoped(Effect.gen(function* () {
+      const deadline = yield* startDeadline(options.timeoutMs ?? LOGIN_TIMEOUT_MS, () => new RequestTimeout({ message: "OAuth login timed out." }));
+      return yield* deadline.guard(Effect.gen(function* () {
+        const code = yield* Deferred.make<string, DevinFailure>();
+        let hasAcceptedCode = false;
+        const accept = (value: string) => {
+          if (hasAcceptedCode || !isAuthorizationCode(value)) return false;
+          hasAcceptedCode = true;
+          authorizationCode = value;
+          Deferred.doneUnsafe(code, Exit.succeed(value));
+          return true;
+        };
+        const redirectURL = flow === "manual" ? undefined : yield* startCallbackServer({
+          state: pkce.state, accept, isSettled: () => hasAcceptedCode,
+          deny: () => {
+            hasAcceptedCode = true;
+            Deferred.doneUnsafe(code, Exit.fail(new DevinError({ message: "OAuth login was denied." })));
+          },
+        });
+        const authorizationURL = new URL(flow === "manual" ? "/devin/account/login" : "/auth/cli/continue", webappURL);
+        authorizationURL.search = new URLSearchParams({
+          redirect_uri: flow === "manual" ? "chisel-show-auth-token" : redirectURL!,
+          state: pkce.state,
+          ...(flow === "manual" ? {} : { prompt: "select_account" }),
+          code_challenge: pkce.challenge, code_challenge_method: "S256",
+        }).toString();
+        yield* options.onURL(authorizationURL.href);
+        // Typed input races the browser callback; the first valid code wins and the other wait is stopped.
+        const input = options.promptCode && !hasAcceptedCode ? yield* Effect.forkScoped(Effect.gen(function* () {
+          const value = (yield* options.promptCode!).trim();
+          if (hasAcceptedCode) return;
+          authorizationCode = value; // Also keeps the raw code out of errors.
+          let candidate = value;
+          if (/^https?:\/\//.test(candidate)) {
+            const pasted = yield* Effect.try({ try: () => new URL(candidate), catch: toDevinError });
+            if (!redirectURL || pasted.origin + pasted.pathname !== redirectURL || !matchesState(pasted.searchParams.get("state"), pkce.state)) {
+              return yield* failWith("The pasted callback URL or state does not match.");
+            }
+            candidate = pasted.searchParams.get("code") ?? "";
           }
-          code = pasted.searchParams.get("code") ?? "";
-        }
-        if (!acceptCode(code)) throw new Error("Enter a valid authorization code. API keys and session tokens are not accepted.");
-      }).catch((error) => { if (!hasAcceptedCode && !signal.aborted) rejectCode(error); });
-    }
-    authorizationCode = await codePromise;
-    signal.throwIfAborted();
-    let sessionToken: string;
-    if (flow === "browser") {
-      sessionToken = await exchangeBrowserCode({ origin: devinAPIURL, code: authorizationCode, verifier: pkce.verifier, signal, fetch: options.fetch });
-    } else {
-      client = new ConnectClient({ baseURL: apiServerURL, timeoutMs: 30_000, fetch: options.fetch });
-      const isWindsurfCode = authorizationCode.startsWith(PKCE_CODE_PREFIX);
-      const method = isWindsurfCode ? PKCE_EXCHANGE_METHOD : EXCHANGE_METHOD;
-      const body = isWindsurfCode ? { authorizationCode: codeForExchange(authorizationCode), codeVerifier: pkce.verifier }
-        : { code: authorizationCode, codeVerifier: pkce.verifier };
-      const exchanged = await client.unary(method, body, signal, { encoding: options.encoding ?? "proto" });
-      if (isWindsurfCode && typeof exchanged.apiServerUrl === "string" && exchanged.apiServerUrl && endpoint(exchanged.apiServerUrl) !== apiServerURL) {
-        throw new Error("The login returned a different API server. Set the target with --api-server-url and sign in again.");
-      }
-      const tokenField = isWindsurfCode ? "apiKey" : "sessionToken";
-      sessionToken = requiredString(exchanged[tokenField], `${method}.${tokenField}`);
-    }
-    return { version: 1, sessionToken, apiServerURL, createdAt: new Date().toISOString() };
-  } catch (error) {
-    const secrets = [authorizationCode, codeForExchange(authorizationCode), pkce.verifier];
-    if (error instanceof RPCError) { error.message = safeError(error, secrets); error.code = safeError(error.code, secrets); throw error; }
-    const failure = new Error(safeError(error, secrets));
-    if (error instanceof Error) failure.name = error.name;
-    throw failure;
-  } finally {
-    inputController.abort();
-    client?.close();
-    signal.removeEventListener("abort", onAbort);
-    server.closeAllConnections();
-    await new Promise<void>((resolve) => server.close(() => resolve()));
-  }
+          if (!accept(candidate)) return yield* failWith("Enter a valid authorization code. API keys and session tokens are not accepted.");
+        }).pipe(Effect.catch((error) => hasAcceptedCode ? Effect.void : Deferred.fail(code, error)))) : undefined;
+        const accepted = yield* Deferred.await(code);
+        if (input) yield* Fiber.interrupt(input);
+        const sessionToken = flow === "browser"
+          ? yield* exchangeBrowserCode({ origin: devinAPIURL, code: accepted, verifier: pkce.verifier })
+          : yield* connectExchange(apiServerURL, accepted, pkce.verifier, options);
+        return { version: 1, sessionToken, apiServerURL, createdAt: new Date().toISOString() } satisfies Credential;
+      }));
+    })).pipe(Effect.catch((error) => Effect.fail(redactFailure(error, secrets()))));
+  });
 }

package/src/core/auth/pkce.ts

@@ -0,0 +1,32 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+
+export const PKCE_CODE_PREFIX = "wspkce$";
+
+export interface PKCE { verifier: string; challenge: string; state: string }
+
+export function createPKCE(): PKCE {
+  const verifier = randomBytes(32).toString("base64url");
+  return {
+    verifier,
+    challenge: createHash("sha256").update(verifier).digest("base64url"),
+    state: randomBytes(32).toString("base64url"),
+  };
+}
+
+/** The code the exchange RPC expects: a Windsurf-style code without its prefix. */
+export function codeForExchange(code: string): string {
+  return code.startsWith(PKCE_CODE_PREFIX) ? code.slice(PKCE_CODE_PREFIX.length) : code;
+}
+
+export function matchesState(received: string | null, expected: string): boolean {
+  if (!received) return false;
+  const left = Buffer.from(received), right = Buffer.from(expected);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+
+/** A one-time authorization code. API keys, session tokens and credentials of other schemes are refused. */
+export function isAuthorizationCode(code: string): boolean {
+  return code.length > 0 && code.length <= 8192 && codeForExchange(code).length > 0
+    && !/[\s\u0000-\u001f\u007f]/.test(code)
+    && !/^(devin-session-token\$|cog_|sk-ws-01-|Bearer |Basic )/.test(code);
+}

package/src/core/auth/rest-exchange.ts

@@ -1,35 +1,37 @@
-import { createHTTPTransport } from "../protocol/http.ts";
-import { awaitWithSignal, boundedJSON, discardResponse, endpoint, RPCError } from "../protocol/transport.ts";
-import { object, requiredString } from "../types.ts";
+import { Effect, Exit } from "effect";
+import { HttpBody, HttpClientRequest } from "effect/http";
+import { startDeadline } from "../cancellation.ts";
+import { RPCError, type DevinFailure } from "../errors.ts";
+import { endpoint } from "../protocol/endpoint.ts";
+import { discardResponse, fromHttpClientError, readBoundedJSON } from "../protocol/http.ts";
+import { HttpTransport } from "../services/http-transport.ts";
+import { failWith, object, requiredString } from "../validation.ts";
 
 const TOKEN_PREFIX = "devin-session-token$";
+const EXCHANGE_TIMEOUT_MS = 30_000;
+const RESPONSE_BYTES = 64 * 1024;
 
 /** REST authorization code exchange, same as the public client. Never resends or creates a refresh grant. */
-export async function exchangeBrowserCode(options: {
-  origin: string; code: string; verifier: string; signal: AbortSignal; fetch?: typeof fetch;
-}): Promise<string> {
-  const origin = endpoint(options.origin);
-  const signal = AbortSignal.any([options.signal, AbortSignal.timeout(30_000)]);
-  signal.throwIfAborted();
-  const transport = options.fetch ? undefined : createHTTPTransport();
-  try {
-    const response = await awaitWithSignal((options.fetch ?? transport!.fetch)(`${origin}/auth/cli/token`, {
-      method: "POST", redirect: "error", signal,
-      headers: { "content-type": "application/json", accept: "application/json" },
-      body: JSON.stringify({ code: options.code, code_verifier: options.verifier }),
-    }), signal, discardResponse);
-    if (!response.ok) {
-      discardResponse(response);
-      throw new RPCError(response.status === 401 ? "unauthenticated" : `http_${response.status}`, "Devin login code exchange failed", response.status);
-    }
-    let body: unknown;
-    try { body = await boundedJSON(response, 64 * 1024, signal); }
-    catch (error) {
-      if (error instanceof SyntaxError) throw new Error("The Devin login response is not valid JSON.");
-      throw error;
-    }
-    const token = requiredString(object(body, "Devin login response").token, "Devin login response.token");
-    if (/[\s\u0000-\u001f\u007f]/.test(token)) throw new Error("The token in the Devin login response has an invalid format.");
-    return token.startsWith(TOKEN_PREFIX) ? token : TOKEN_PREFIX + token;
-  } finally { transport?.close(); }
+export function exchangeBrowserCode(options: { origin: string; code: string; verifier: string }): Effect.Effect<string, DevinFailure, HttpTransport> {
+  return Effect.scoped(Effect.gen(function* () {
+    const origin = yield* endpoint(options.origin);
+    const deadline = yield* startDeadline(EXCHANGE_TIMEOUT_MS);
+    const http = yield* (yield* HttpTransport).open;
+    return yield* deadline.guard(Effect.gen(function* () {
+      const request = HttpClientRequest.post(`${origin}/auth/cli/token`).pipe(
+        HttpClientRequest.setBody(HttpBody.raw(JSON.stringify({ code: options.code, code_verifier: options.verifier }))),
+        HttpClientRequest.setHeaders({ "content-type": "application/json", accept: "application/json" }),
+      );
+      const response = yield* http.execute(request).pipe(Effect.mapError(fromHttpClientError));
+      yield* Effect.addFinalizer((exit) => Exit.isSuccess(exit) ? Effect.void : discardResponse(response));
+      if (response.status < 200 || response.status >= 300) {
+        yield* discardResponse(response);
+        return yield* Effect.fail(RPCError.make(response.status === 401 ? "unauthenticated" : `http_${response.status}`, "Devin login code exchange failed", response.status));
+      }
+      const body = yield* object(yield* readBoundedJSON(response, RESPONSE_BYTES), "Devin login response");
+      const token = yield* requiredString(body.token, "Devin login response.token");
+      if (/[\s\u0000-\u001f\u007f]/.test(token)) return yield* failWith("The token in the Devin login response has an invalid format.");
+      return token.startsWith(TOKEN_PREFIX) ? token : TOKEN_PREFIX + token;
+    }));
+  }));
 }