@buyong/pi-devin 0.1.5 → 0.1.6

package/src/core/protocol/protobuf.ts

@@ -1,20 +1,21 @@
 import { readdirSync, statSync } from "node:fs";
 import { isAbsolute, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { Effect } from "effect";
 import protobuf from "protobufjs";
-import { object, type JsonObject } from "../types.ts";
+import { DevinError, toDevinError } from "../errors.ts";
+import type { JsonObject } from "../types.ts";
+import { failWith, object } from "../validation.ts";
 
 export const CHAT_METHOD = "exa.api_server_pb.ApiServerService/GetChatMessage";
 
 export interface MessageCodec {
-  encode(value: JsonObject): Uint8Array;
-  decode(bytes: Uint8Array): JsonObject;
+  encode(value: JsonObject): Effect.Effect<Uint8Array, DevinError>;
+  decode(bytes: Uint8Array): Effect.Effect<JsonObject, DevinError>;
 }
 
-let root: protobuf.Root | undefined;
-const camelCase = (name: string) => name.replace(/_([a-z])/g, (_, letter: string) => letter.toUpperCase());
-
 const PROTO_ROOT = fileURLToPath(new URL("../../../proto/", import.meta.url));
+const camelCase = (name: string) => name.replace(/_([a-z])/g, (_, letter: string) => letter.toUpperCase());
 
 function protoSources(directory: string, out: string[] = []): string[] {
   for (const entry of readdirSync(directory)) {
@@ -25,87 +26,105 @@ function protoSources(directory: string, out: string[] = []): string[] {
   return out;
 }
 
-function getRoot(): protobuf.Root {
-  if (!root) {
-    // The schema is the shipped `proto/` source tree, parsed directly. The four definitions this
-    // package added from its own protocol analysis are marked in the sources, so nothing is
-    // patched in at runtime. keepCase keeps the declared snake_case names the DTO boundary uses.
-    root = new protobuf.Root();
+let loadedRoot: protobuf.Root | undefined;
+
+/**
+ * The schema is the shipped `proto/` source tree, parsed once per process. The four definitions this
+ * package added from its own protocol analysis are marked in the sources, so nothing is patched in at
+ * runtime. keepCase keeps the declared snake_case names the DTO boundary uses.
+ */
+const schemaRoot: Effect.Effect<protobuf.Root, DevinError> = Effect.suspend(() => loadedRoot ? Effect.succeed(loadedRoot) : Effect.try({
+  try: () => {
+    const root = new protobuf.Root();
     root.resolvePath = (_origin: string, target: string) => isAbsolute(target) ? target : join(PROTO_ROOT, target);
     root.loadSync(protoSources(PROTO_ROOT), { keepCase: true });
     root.resolveAll();
-  }
-  return root;
-}
+    loadedRoot = root;
+    return root;
+  },
+  catch: toDevinError,
+}));
 
 /** Converts between camelCase DTOs and the original snake_case at the boundary; user keys inside maps stay unchanged. */
-function convertFields(type: protobuf.Type, value: JsonObject, isEncoding: boolean, path: string): JsonObject {
-  const result: [string, unknown][] = [];
-  for (const [name, entry] of Object.entries(value)) {
-    if (entry === undefined || entry === null) continue;
-    const field = isEncoding ? type.fieldsArray.find((candidate) => camelCase(candidate.name) === name)
-      : Object.hasOwn(type.fields, name) ? type.fields[name] : undefined;
-    if (!field) throw new Error(`Field not in the protobuf schema: ${path}.${name}`);
-    const convert = (item: unknown): unknown => {
-      if (field.resolvedType instanceof protobuf.Type) {
-        return convertFields(field.resolvedType, object(item, `${path}.${name}`), isEncoding, `${path}.${name}`);
-      }
-      // Prevents fromObject from silently turning an invalid enum into 0.
-      if (isEncoding && field.resolvedType instanceof protobuf.Enum) {
-        const isValid = typeof item === "string" ? Object.hasOwn(field.resolvedType.values, item)
-          : typeof item === "number" && Object.hasOwn(field.resolvedType.valuesById, item);
-        if (!isValid) throw new Error(`Unknown protobuf enum: ${path}.${name}`);
-      }
-      return item;
-    };
-    let converted: unknown;
-    if (field.map) converted = Object.fromEntries(Object.entries(object(entry, `${path}.${name}`)).map(([key, item]) => [key, convert(item)]));
-    else if (field.repeated) {
-      if (!Array.isArray(entry)) throw new Error(`Field requires an array: ${path}.${name}`);
-      converted = entry.map(convert);
-    } else converted = convert(entry);
-    result.push([isEncoding ? field.name : camelCase(field.name), converted]);
-  }
-  return Object.fromEntries(result);
+function convertFields(type: protobuf.Type, value: JsonObject, isEncoding: boolean, path: string): Effect.Effect<JsonObject, DevinError> {
+  return Effect.gen(function* () {
+    const result: [string, unknown][] = [];
+    for (const [name, entry] of Object.entries(value)) {
+      if (entry === undefined || entry === null) continue;
+      const field = isEncoding ? type.fieldsArray.find((candidate) => camelCase(candidate.name) === name)
+        : Object.hasOwn(type.fields, name) ? type.fields[name] : undefined;
+      if (!field) return yield* failWith(`Field not in the protobuf schema: ${path}.${name}`);
+      const label = `${path}.${name}`;
+      const convert = (item: unknown): Effect.Effect<unknown, DevinError> => {
+        if (field.resolvedType instanceof protobuf.Type) {
+          const nested = field.resolvedType;
+          return object(item, label).pipe(Effect.flatMap((fields) => convertFields(nested, fields, isEncoding, label)));
+        }
+        // Prevents fromObject from silently turning an invalid enum into 0.
+        if (isEncoding && field.resolvedType instanceof protobuf.Enum) {
+          const values = field.resolvedType;
+          const isValid = typeof item === "string" ? Object.hasOwn(values.values, item)
+            : typeof item === "number" && Object.hasOwn(values.valuesById, item);
+          if (!isValid) return failWith(`Unknown protobuf enum: ${label}`);
+        }
+        return Effect.succeed(item);
+      };
+      let converted: unknown;
+      if (field.map) {
+        const entries = Object.entries(yield* object(entry, label));
+        converted = Object.fromEntries(yield* Effect.forEach(entries, ([key, item]) => Effect.map(convert(item), (mapped) => [key, mapped] as const)));
+      } else if (field.repeated) {
+        if (!Array.isArray(entry)) return yield* failWith(`Field requires an array: ${label}`);
+        converted = yield* Effect.forEach(entry, convert);
+      } else converted = yield* convert(entry);
+      result.push([isEncoding ? field.name : camelCase(field.name), converted]);
+    }
+    return Object.fromEntries(result);
+  });
 }
 
 function messageCodec(typeName: string): MessageCodec {
-  const getType = () => getRoot().lookupType(typeName);
+  const messageType = Effect.flatMap(schemaRoot, (root) => Effect.try({ try: () => root.lookupType(typeName), catch: toDevinError }));
   return {
-    encode(value) {
-      const type = getType();
-      const message = type.fromObject(convertFields(type, value, true, typeName));
+    encode: (value) => Effect.gen(function* () {
+      const type = yield* messageType;
+      const fields = yield* convertFields(type, value, true, typeName);
+      const message = yield* Effect.try({ try: () => type.fromObject(fields), catch: toDevinError });
       const error = type.verify(message);
-      if (error) throw new Error(`Invalid protobuf input: ${error}`);
-      return type.encode(message).finish();
-    },
-    decode(bytes) {
-      const type = getType();
-      try {
-        const decoded = object(type.toObject(type.decode(bytes), {
-          longs: String, enums: String, bytes: String, defaults: false,
-        }), typeName);
-        return convertFields(type, decoded, false, typeName);
-      } catch {
-        throw new Error(`Invalid protobuf response: ${typeName}`);
-      }
-    },
+      if (error) return yield* failWith(`Invalid protobuf input: ${error}`);
+      return yield* Effect.try({ try: () => type.encode(message).finish(), catch: toDevinError });
+    }),
+    decode: (bytes) => Effect.flatMap(messageType, (type) => Effect.gen(function* () {
+      const decoded = yield* Effect.try({
+        try: () => type.toObject(type.decode(bytes), { longs: String, enums: String, bytes: String, defaults: false }),
+        catch: toDevinError,
+      });
+      return yield* convertFields(type, yield* object(decoded, typeName), false, typeName);
+    }).pipe(Effect.mapError(() => new DevinError({ message: `Invalid protobuf response: ${typeName}` })))),
   };
 }
 
-export function unaryCodecs(method: string): { request: MessageCodec; response: MessageCodec } {
-  const split = method.lastIndexOf("/");
-  if (split <= 0) throw new Error("A valid RPC path is required.");
-  const service = getRoot().lookupService(method.slice(0, split));
-  const definition = service.methods[method.slice(split + 1)];
-  definition?.resolve();
-  if (!definition?.resolvedRequestType || !definition.resolvedResponseType || definition.responseStream || definition.requestStream) {
-    throw new Error(`Unsupported unary RPC: ${method}`);
-  }
-  return {
-    request: messageCodec(definition.resolvedRequestType.fullName),
-    response: messageCodec(definition.resolvedResponseType.fullName),
-  };
+export function unaryCodecs(method: string): Effect.Effect<{ request: MessageCodec; response: MessageCodec }, DevinError> {
+  return Effect.gen(function* () {
+    const split = method.lastIndexOf("/");
+    if (split <= 0) return yield* failWith("A valid RPC path is required.");
+    const root = yield* schemaRoot;
+    const definition = yield* Effect.try({
+      try: () => {
+        const found = root.lookupService(method.slice(0, split)).methods[method.slice(split + 1)];
+        found?.resolve();
+        return found;
+      },
+      catch: toDevinError,
+    });
+    if (!definition?.resolvedRequestType || !definition.resolvedResponseType || definition.responseStream || definition.requestStream) {
+      return yield* failWith(`Unsupported unary RPC: ${method}`);
+    }
+    return {
+      request: messageCodec(definition.resolvedRequestType.fullName),
+      response: messageCodec(definition.resolvedResponseType.fullName),
+    };
+  });
 }
 
 export const chatRequestCodec = messageCodec("exa.api_server_pb.GetChatMessageRequest");

package/src/core/redaction.ts

@@ -0,0 +1,33 @@
+import { Predicate } from "effect";
+import { Cancelled, DevinError, RequestTimeout, RPCError, type DevinFailure } from "./errors.ts";
+import type { JsonObject } from "./types.ts";
+
+export function safeError(error: unknown, secrets: readonly string[] = []): string {
+  let text = error instanceof Error ? error.message : String(error);
+  for (const secret of secrets) if (secret) text = text.split(secret).join("[REDACTED]");
+  return text.replace(/devin-session-token\$[^\s"'<>]+/g, "[REDACTED]")
+    .replace(/[\u0000-\u0008\u000b-\u001f\u007f]/g, "").slice(0, 800);
+}
+
+export function requestSecrets(body: JsonObject, token?: string): string[] {
+  const metadata = Predicate.isObject(body.metadata) ? body.metadata as JsonObject : {};
+  // f is ciphertext that contains the API token. Treat it as sensitive as the token itself.
+  const uppercaseFingerprint = Predicate.isString(metadata.f) ? metadata.f.toUpperCase() : undefined;
+  return [token, metadata.apiKey, metadata.f, uppercaseFingerprint, body.apiKey, body.modelAssignmentJwt, body.code, body.authorizationCode, body.codeVerifier]
+    .filter((value): value is string => Predicate.isString(value) && value.length > 0);
+}
+
+/** The same failure with tokens, codes and other secrets removed from its message. */
+export function redactFailure(failure: DevinFailure, secrets: readonly string[]): DevinFailure {
+  switch (failure._tag) {
+    case "RPCError": return new RPCError({
+      code: safeError(failure.code, secrets), message: safeError(failure, secrets),
+      httpStatus: failure.httpStatus, retryAfterMs: failure.retryAfterMs,
+    });
+    case "DevinError": return new DevinError({
+      message: safeError(failure, secrets), code: failure.code === undefined ? undefined : safeError(failure.code, secrets),
+    });
+    case "Cancelled": return new Cancelled({ message: safeError(failure, secrets) });
+    case "RequestTimeout": return new RequestTimeout({ message: safeError(failure, secrets) });
+  }
+}

package/src/core/services/device-identity.ts

@@ -0,0 +1,15 @@
+import { Context, Effect, Layer } from "effect";
+import { ChildProcessSpawner } from "effect/process";
+import { collectDeviceIdentity, nodeDeviceSystem, type DeviceIdentity } from "../protocol/device.ts";
+
+export interface DeviceIdentitySourceShape {
+  /** Reads the device values the request fingerprint is built from. Never fails: unreadable values become their documented empty value. */
+  readonly collect: Effect.Effect<DeviceIdentity>;
+}
+
+/** Where request fingerprints get their device values. Each fingerprint provider collects once and keeps the result. */
+export class DeviceIdentitySource extends Context.Service<DeviceIdentitySource, DeviceIdentitySourceShape>()("pi-devin/DeviceIdentitySource") {}
+
+/** Reads this machine through the process and network APIs. */
+export const NodeDeviceIdentitySource: Layer.Layer<DeviceIdentitySource, never, ChildProcessSpawner.ChildProcessSpawner> = Layer.effect(DeviceIdentitySource,
+  Effect.map(ChildProcessSpawner.ChildProcessSpawner, (spawner) => ({ collect: collectDeviceIdentity(nodeDeviceSystem(spawner)) })));

package/src/core/services/http-transport.ts

@@ -0,0 +1,28 @@
+import { Context, Effect, Layer, type Scope } from "effect";
+import type { HttpClient } from "effect/http";
+import { makeFetchHttpClient } from "../protocol/http/fetch-client.ts";
+import { makeNodeHttpClient, type HTTPTransportOptions } from "../protocol/http/node-client.ts";
+
+export interface HttpTransportShape {
+  /**
+   * An `HttpClient` for the calling scope. The built-in transport opens its own keep-alive pool and destroys it with the scope,
+   * so clients never share connections and closing one never drops another's.
+   */
+  readonly open: Effect.Effect<HttpClient.HttpClient, never, Scope.Scope>;
+}
+
+/** How Devin clients and logins reach the network. */
+export class HttpTransport extends Context.Service<HttpTransport, HttpTransportShape>()("pi-devin/HttpTransport") {}
+
+/** Node's `http`/`https`: TLS 1.2 or later with certificate and host checks, HTTP/1.1 only, and a pool per opening scope. */
+export function nodeTransport(options: HTTPTransportOptions = {}): HttpTransportShape {
+  return { open: makeNodeHttpClient(options) };
+}
+
+/** An injected `fetch`, such as the one Pi passes in stream options. */
+export function fetchTransport(fetchImpl: typeof fetch): HttpTransportShape {
+  return { open: Effect.sync(() => makeFetchHttpClient(fetchImpl)) };
+}
+
+export const NodeHttpTransport = (options?: HTTPTransportOptions): Layer.Layer<HttpTransport> => Layer.succeed(HttpTransport, nodeTransport(options));
+export const FetchHttpTransport = (fetchImpl: typeof fetch): Layer.Layer<HttpTransport> => Layer.succeed(HttpTransport, fetchTransport(fetchImpl));

package/src/core/services/platform.ts

@@ -0,0 +1,54 @@
+import { Effect, Layer, Stream } from "effect";
+import type { PlatformError } from "effect/PlatformError";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+// Subpath imports: the package index also loads NodeRedis, whose `redis` peer Pi's installer does not install.
+import * as NodeChildProcessSpawner from "@effect/platform-node/NodeChildProcessSpawner";
+import * as NodeFileSystem from "@effect/platform-node/NodeFileSystem";
+import * as NodePath from "@effect/platform-node/NodePath";
+import { DevinError, toDevinError } from "../errors.ts";
+
+/** Keeps the operating system's own message and error code, as the Node APIs reported them. */
+export function fromPlatformError(error: PlatformError): DevinError {
+  const cause = error.reason.cause;
+  return cause === undefined ? new DevinError({ message: error.message }) : toDevinError(cause);
+}
+
+/** Node implementations of the process and file services this package uses. */
+export const NodePlatformLayer = Layer.mergeAll(
+  NodeChildProcessSpawner.layer.pipe(Layer.provide(Layer.mergeAll(NodeFileSystem.layer, NodePath.layer))),
+  NodeFileSystem.layer,
+  NodePath.layer,
+);
+
+export interface CommandOutputOptions {
+  env: Record<string, string>;
+  timeoutMs: number;
+  maxOutputBytes: number;
+}
+
+/** Runs a fixed command without a shell input and returns its stdout, like `execFileSync` with an output bound. */
+export function commandOutput(file: string, args: readonly string[], options: CommandOutputOptions): Effect.Effect<string, DevinError, ChildProcessSpawner.ChildProcessSpawner> {
+  return Effect.scoped(Effect.gen(function* () {
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const handle = yield* spawner.spawn(ChildProcess.make(file, [...args], {
+      env: options.env, extendEnv: false, detached: false, stdin: "ignore", stderr: "ignore",
+    })).pipe(Effect.mapError(fromPlatformError));
+    let bytes = 0;
+    const chunks: Uint8Array[] = [];
+    yield* handle.stdout.pipe(
+      Stream.mapError(fromPlatformError),
+      Stream.runForEach((chunk) => {
+        bytes += chunk.byteLength;
+        if (bytes > options.maxOutputBytes) return Effect.fail(new DevinError({ message: `${file} output exceeds ${options.maxOutputBytes} bytes.` }));
+        chunks.push(chunk);
+        return Effect.void;
+      }),
+    );
+    const exitCode = yield* handle.exitCode.pipe(Effect.mapError(fromPlatformError));
+    if (exitCode !== 0) return yield* Effect.fail(new DevinError({ message: `${file} exited with code ${exitCode}.` }));
+    return Buffer.concat(chunks).toString("utf8");
+  })).pipe(Effect.timeoutOrElse({
+    duration: options.timeoutMs,
+    orElse: () => Effect.fail(new DevinError({ message: `${file} timed out after ${options.timeoutMs}ms.`, code: "ETIMEDOUT" })),
+  }));
+}

package/src/core/types.ts

@@ -1,28 +1,5 @@
 export type JsonObject = Record<string, unknown>;
 
-export function object(value: unknown, label: string): JsonObject {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${label}: a JSON object is required.`);
-  }
-  return value as JsonObject;
-}
-
-export function requiredString(value: unknown, label: string): string {
-  if (typeof value !== "string" || value.length === 0) {
-    throw new Error(`${label}: a non-empty string is required.`);
-  }
-  return value;
-}
-
-export function tokenCount(value: unknown, label: string): number {
-  if (typeof value !== "number" && !(typeof value === "string" && /^\d+$/.test(value))) {
-    throw new Error(`${label}: invalid token count.`);
-  }
-  const count = Number(value);
-  if (!Number.isSafeInteger(count) || count < 0) throw new Error(`${label}: invalid token count.`);
-  return count;
-}
-
 export interface Credential {
   version: 1;
   sessionToken: string;
@@ -87,6 +64,8 @@ export interface ChatResult {
   stopFrameIndex?: number;
   lastUsageFrameIndex?: number;
   idlessToolDeltaCount: number;
+  /** Tool call ID → why its arguments cannot run, in Pi's `argumentsError` wording. */
+  toolArgumentErrors: Readonly<Record<string, string>>;
   durationMs: number;
   firstDeltaMs?: number;
   actualModelUid?: string;

package/src/core/validation.ts

@@ -0,0 +1,25 @@
+import { Effect, Predicate } from "effect";
+import { DevinError } from "./errors.ts";
+import type { JsonObject } from "./types.ts";
+
+export function object(value: unknown, label: string): Effect.Effect<JsonObject, DevinError> {
+  return Predicate.isObject(value) ? Effect.succeed(value as JsonObject)
+    : Effect.fail(new DevinError({ message: `${label}: a JSON object is required.` }));
+}
+
+export function requiredString(value: unknown, label: string): Effect.Effect<string, DevinError> {
+  return Predicate.isString(value) && value.length > 0 ? Effect.succeed(value)
+    : Effect.fail(new DevinError({ message: `${label}: a non-empty string is required.` }));
+}
+
+export function tokenCount(value: unknown, label: string): Effect.Effect<number, DevinError> {
+  const isCountLike = Predicate.isNumber(value) || (Predicate.isString(value) && /^\d+$/.test(value));
+  const count = Number(value);
+  return isCountLike && Number.isSafeInteger(count) && count >= 0 ? Effect.succeed(count)
+    : Effect.fail(new DevinError({ message: `${label}: invalid token count.` }));
+}
+
+/** Fails with a message-only error. */
+export function failWith(message: string): Effect.Effect<never, DevinError> {
+  return Effect.fail(new DevinError({ message }));
+}

package/src/pi/adapters/pi/devin-command.ts

@@ -0,0 +1,82 @@
+import type { ExtensionAPI, ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
+import { Effect } from "effect";
+import { toDevinFailure, type DevinError, type DevinFailure } from "../../../core/errors.ts";
+import { ExtensionConfig } from "../../app/config.ts";
+import type { ExtensionRuntime } from "../../app/runtime.ts";
+import { ModelCatalog } from "../../features/catalog/service.ts";
+import { DisplaySettings } from "../../features/settings/service.ts";
+import type { DevinPreferences } from "../../features/settings/types.ts";
+import { sessionUsage, usageReport } from "../../features/usage/report.ts";
+import { DevinPanel, PREFERENCE_ITEMS } from "./ui/devin-panel.ts";
+import { UsageStatus } from "./usage-status.ts";
+
+export const DEVIN_COMMAND_NAME = "devin";
+const USAGE = "Usage: /devin, /devin recommended on|off, /devin status on|off";
+const ARGUMENT_KEYS: Readonly<Record<string, keyof DevinPreferences>> = { recommended: "recommendedOnly", status: "showUsageStatus" };
+
+const onOff = (value: boolean) => value ? "on" : "off";
+
+/** Saves the settings and applies them: a changed filter rebuilds Pi's model snapshots without network. Only a failed save fails. */
+const applyPreferences = (ctx: ExtensionCommandContext, next: DevinPreferences): Effect.Effect<void, DevinError, DisplaySettings | ModelCatalog | UsageStatus> => Effect.gen(function* () {
+  const settings = yield* DisplaySettings;
+  const catalog = yield* ModelCatalog;
+  const previous = yield* settings.read;
+  // A list refresh failure after saving is reported as a warning so the screen and the saved value stay in sync.
+  yield* settings.write(next);
+  if (previous.recommendedOnly !== next.recommendedOnly) {
+    yield* catalog.rebuild;
+    // Pi keeps model and availability snapshots. Rebuild them without network so `/model` and RPC lists update immediately.
+    yield* Effect.tryPromise({ try: () => ctx.modelRegistry.refresh({ providers: ["devin"], allowNetwork: false }), catch: toDevinFailure }).pipe(
+      Effect.catch((error) => Effect.sync(() => ctx.ui.notify(`Settings were saved, but the model list could not be rebuilt: ${error.message}`, "warning"))),
+    );
+    const model = ctx.model;
+    if (model?.provider === "devin" && !(yield* catalog.models).some((item) => item.id === model.id)) {
+      ctx.ui.notify(`The current model ${model.name} is now hidden from the list but stays in use for this session. To restore it when reopening the session, pick a model from the list.`, "warning");
+    }
+  }
+  yield* (yield* UsageStatus).update(ctx);
+});
+
+const devinCommand = (args: string, ctx: ExtensionCommandContext, runtime: ExtensionRuntime): Effect.Effect<void, DevinFailure, DisplaySettings | ModelCatalog | UsageStatus | ExtensionConfig> => Effect.gen(function* () {
+  const settings = yield* DisplaySettings;
+  const status = yield* UsageStatus;
+  const { now } = yield* ExtensionConfig;
+  const report = () => runtime.runSync(Effect.gen(function* () {
+    return usageReport(yield* status.accountUsage, sessionUsage(ctx.sessionManager.getBranch()), now());
+  }));
+  const tokens = args.trim().split(/\s+/).filter(Boolean);
+  if (tokens.length) {
+    const key = ARGUMENT_KEYS[tokens[0]];
+    if (tokens.length !== 2 || !key || (tokens[1] !== "on" && tokens[1] !== "off")) {
+      ctx.ui.notify(`Unknown argument. ${USAGE}`, "error");
+      return;
+    }
+    const value = tokens[1] === "on";
+    yield* applyPreferences(ctx, { ...(yield* settings.read), [key]: value });
+    ctx.ui.notify(`${PREFERENCE_ITEMS.find((item) => item.key === key)!.label}: ${onOff(value)} (saved globally)`, "info");
+    return;
+  }
+  if (ctx.mode === "tui") {
+    const preferences = yield* settings.read;
+    const services = yield* Effect.context<DisplaySettings | ModelCatalog | UsageStatus>();
+    yield* Effect.tryPromise({ try: () => ctx.ui.custom<void>((tui, theme, _keybindings, done) => new DevinPanel({
+      theme, report, preferences, onChange: (next) => applyPreferences(ctx, next).pipe(Effect.provideContext(services)),
+      requestRender: () => tui.requestRender(), done: () => done(),
+    })), catch: toDevinFailure });
+    return;
+  }
+  const preferences = yield* settings.read;
+  const summary = PREFERENCE_ITEMS.map((item) => `${item.label} ${onOff(preferences[item.key])}`).join(" · ");
+  ctx.ui.notify([...report().map((line) => line.text), `Settings: ${summary}`, USAGE].join("\n"), "info");
+});
+
+/**
+ * `/devin` shows usage details and display settings. Settings are saved globally and applied immediately.
+ * The TUI gets a dedicated screen; other modes use arguments and notifications.
+ */
+export function registerDevinCommand(pi: ExtensionAPI, runtime: ExtensionRuntime): void {
+  pi.registerCommand(DEVIN_COMMAND_NAME, {
+    description: "Show Devin usage and change display settings (recommended models only, usage in the status line); saved globally",
+    handler: (args, ctx) => runtime.runPromise(devinCommand(args, ctx, runtime)),
+  });
+}

package/src/pi/adapters/pi/fusion-command.ts

@@ -0,0 +1,92 @@
+import type { ExtensionAPI, ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
+import { Effect } from "effect";
+import { toDevinFailure, type DevinFailure } from "../../../core/errors.ts";
+import type { ExtensionRuntime } from "../../app/runtime.ts";
+import { FUSION_MODEL_ID } from "../../features/catalog/constants.ts";
+import { ModelCatalog } from "../../features/catalog/service.ts";
+import type { DevinModel, FusionChoices, FusionSelection } from "../../features/catalog/types.ts";
+import { FusionSettings } from "../../features/settings/service.ts";
+import { FusionPicker } from "./ui/fusion-picker.ts";
+
+export const FUSION_COMMAND_NAME = "devin-fusion";
+const USAGE = `Usage: /${FUSION_COMMAND_NAME} or /${FUSION_COMMAND_NAME} <lead model ID> <sidekick model ID>`;
+
+const host = <A>(evaluate: () => Promise<A>) => Effect.tryPromise({ try: evaluate, catch: toDevinFailure });
+
+const currentFusion = (models: readonly DevinModel[]) => models.find((model) => model.id === FUSION_MODEL_ID);
+
+/** Disambiguates duplicate display names in a select list with an index, and maps the chosen label back to its value. */
+function choose<T>(ctx: ExtensionCommandContext, title: string, items: readonly T[], label: (item: T) => string, isCurrent: (item: T) => boolean): Effect.Effect<T | undefined, DevinFailure> {
+  const names = items.map(label);
+  const labels = items.map((item, index) => {
+    const name = names.filter((other) => other === names[index]).length > 1 ? `${names[index]} (${index + 1})` : names[index];
+    return (isCurrent(item) ? "● " : "  ") + name;
+  });
+  return Effect.map(host(() => ctx.ui.select(title, labels)), (picked) => picked === undefined ? undefined : items[labels.indexOf(picked)]);
+}
+
+function pickInteractively(ctx: ExtensionCommandContext, choices: FusionChoices, current: FusionSelection | undefined): Effect.Effect<FusionSelection | undefined, DevinFailure> {
+  return Effect.gen(function* () {
+    const lead = yield* choose(ctx, "Devin Fusion · lead model", choices.leads, (item) => item.name, (item) => item.id === current?.leadID);
+    if (!lead) return undefined;
+    const groups = [...new Set(choices.sidekicks.map((item) => item.groupName))];
+    const currentGroup = choices.sidekicks.find((item) => item.id === current?.sidekickID)?.groupName;
+    const group = groups.length === 1 ? groups[0] : yield* choose(ctx, "Devin Fusion · sidekick model", groups, (item) => item, (item) => item === currentGroup);
+    if (group === undefined) return undefined;
+    const variants = choices.sidekicks.filter((item) => item.groupName === group);
+    const sidekick = variants.length === 1 ? variants[0]
+      : yield* choose(ctx, `Devin Fusion · sidekick variant (${group})`, variants, (item) => item.name, (item) => item.id === current?.sidekickID);
+    return sidekick ? { leadID: lead.id, sidekickID: sidekick.id } : undefined;
+  });
+}
+
+const fusionCommand = (args: string, ctx: ExtensionCommandContext, pi: ExtensionAPI): Effect.Effect<void, DevinFailure, ModelCatalog | FusionSettings> => Effect.gen(function* () {
+  const catalog = yield* ModelCatalog;
+  const settings = yield* FusionSettings;
+  const choices = yield* catalog.fusionChoices;
+  if (!choices?.leads.length || !choices.sidekicks.length) {
+    ctx.ui.notify("No Devin models are available for Fusion. Check that the model list refreshed after /login.", "warning");
+    return;
+  }
+  const before = currentFusion(yield* catalog.models);
+  const tokens = args.trim().split(/\s+/).filter(Boolean);
+  let selection: FusionSelection | undefined;
+  if (tokens.length) {
+    const [leadID, sidekickID] = tokens;
+    if (tokens.length !== 2 || !choices.leads.some((item) => item.id === leadID) || !choices.sidekicks.some((item) => item.id === sidekickID)) {
+      ctx.ui.notify(`This model cannot be used for Fusion. ${USAGE}`, "error");
+      return;
+    }
+    selection = { leadID, sidekickID };
+  } else if (ctx.mode === "tui") {
+    selection = yield* host(() => ctx.ui.custom<FusionSelection | undefined>((tui, theme, _keybindings, done) => new FusionPicker({
+      choices, current: before?.devin.fusion, theme, requestRender: () => tui.requestRender(), done,
+    })));
+    if (!selection) return;
+  } else if (ctx.hasUI) {
+    // RPC clients cannot draw the custom screen, so they get the select dialogs.
+    selection = yield* pickInteractively(ctx, choices, before?.devin.fusion);
+    if (!selection) return;
+  } else {
+    ctx.ui.notify(before ? `Current: ${before.name}` : `No Devin Fusion pair is set. ${USAGE}`, "info");
+    return;
+  }
+  yield* settings.write(selection);
+  yield* catalog.rebuild;
+  // Pi keeps model and availability snapshots. Rebuild them without network so `/model` and RPC lists update immediately.
+  yield* host(() => ctx.modelRegistry.refresh({ providers: ["devin"], allowNetwork: false }));
+  const after = currentFusion(yield* catalog.models);
+  if (after && ctx.model?.provider === "devin" && ctx.model.id === FUSION_MODEL_ID) yield* host(() => pi.setModel(after));
+  ctx.ui.notify(after ? `Saved ${after.name}. Pick Devin Fusion in /model to use it.` : "The Fusion pair was saved, but it cannot be built from the current model list.", "info");
+});
+
+/**
+ * `/devin-fusion` only chooses the lead/sidekick pair. Whether Fusion is used is decided by picking Devin Fusion in `/model`.
+ * If the current model is Fusion, it is re-selected with the updated model object so the thinking level range matches.
+ */
+export function registerFusionCommand(pi: ExtensionAPI, runtime: ExtensionRuntime): void {
+  pi.registerCommand(FUSION_COMMAND_NAME, {
+    description: "Choose the lead and sidekick models for Devin Fusion (saved globally)",
+    handler: (args, ctx) => runtime.runPromise(fusionCommand(args, ctx, pi)),
+  });
+}

package/src/pi/adapters/pi/oauth.ts

@@ -0,0 +1,14 @@
+import type { OAuthAuth } from "@earendil-works/pi-ai";
+import type { ProviderRuntime } from "../../app/runtime.ts";
+import { AccountLogin } from "../../features/auth/login.ts";
+
+/** Pi's OAuth contract over the sign-in service. Promises reject with the original failure, so Pi sees its name and message. */
+export function makeOAuthAuth(runtime: ProviderRuntime): OAuthAuth {
+  const accountLogin = runtime.runSync(AccountLogin);
+  return {
+    name: "Devin account",
+    login: (interaction) => runtime.runPromise(accountLogin.login(interaction)),
+    refresh: (current, signal) => runtime.runPromise(accountLogin.refresh(current, signal)),
+    toAuth: (current) => runtime.runPromise(accountLogin.toAuth(current)),
+  };
+}

package/src/pi/adapters/pi/provider.ts

@@ -0,0 +1,22 @@
+import type { ProviderRuntime } from "../../app/runtime.ts";
+import { ModelCatalog } from "../../features/catalog/service.ts";
+import { Inference } from "../../features/inference/service.ts";
+import { makeOAuthAuth } from "./oauth.ts";
+import type { DevinProvider } from "./types.ts";
+
+/**
+ * The provider Pi registers. Building it builds the runtime's layers, which perform no I/O; work starts with Pi's first refresh or request.
+ * Pi's synchronous calls run synchronous effects; `stream` returns at once while the request runs in a fiber the inference service owns.
+ */
+export function makeDevinProvider(runtime: ProviderRuntime): DevinProvider {
+  const catalog = runtime.runSync(ModelCatalog);
+  const inference = runtime.runSync(Inference);
+  return {
+    id: "devin", name: "Devin", auth: { oauth: makeOAuthAuth(runtime) },
+    getModels: () => runtime.runSync(catalog.models),
+    filterModels: (models, credential) => runtime.runSync(catalog.filter(models, credential)),
+    refreshModels: (context) => runtime.runPromise(catalog.refresh(context)),
+    stream: (model, context, options) => runtime.runSync(inference.start(model, context, options)),
+    streamSimple: (model, context, options) => runtime.runSync(inference.start(model, context, options)),
+  };
+}