@buyong/pi-devin 0.1.5 → 0.1.6

package/src/pi/adapters/storage/files.ts

@@ -0,0 +1,66 @@
+import { join } from "node:path";
+import { Effect, Layer, Option, Schema } from "effect";
+import { DisplaySettings, DEFAULT_PREFERENCES, FusionSettings, isNotOlder, UsageStore } from "../../features/settings/service.ts";
+import type { DisplaySettingsShape, FusionSettingsShape, UsageStoreShape } from "../../features/settings/types.ts";
+import type { FusionSelection } from "../../features/catalog/types.ts";
+import { readJsonFile, writeJsonFile } from "./json-file.ts";
+
+const SCHEMA_VERSION = 1;
+
+export const fusionSettingsPath = (agentDir: string) => join(agentDir, "pi-devin", "fusion.json");
+export const devinSettingsPath = (agentDir: string) => join(agentDir, "pi-devin", "settings.json");
+export const accountUsagePath = (agentDir: string) => join(agentDir, "pi-devin", "account-usage.json");
+
+const ModelID = Schema.String.check(Schema.makeFilter((value: string) => value.trim() !== ""));
+// Legacy IDs (`family:…`, `uid:…`) are read as is. `effectiveFusion` maps them to the current catalog's IDs.
+const FusionFile = Schema.Struct({ schemaVersion: Schema.Literal(SCHEMA_VERSION), leadID: ModelID, sidekickID: ModelID });
+const SettingsFile = Schema.Struct({ schemaVersion: Schema.Literal(SCHEMA_VERSION), recommendedOnly: Schema.Boolean, showUsageStatus: Schema.Boolean });
+const Percent = Schema.optionalKey(Schema.Finite);
+const UsageRecord = Schema.Struct({
+  schemaVersion: Schema.Literal(SCHEMA_VERSION),
+  scope: Schema.String.check(Schema.isPattern(/^[a-f0-9]{64}$/)),
+  usage: Schema.Struct({
+    fetchedAtMs: Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER })),
+    billingStrategy: Schema.optionalKey(Schema.String),
+    dailyRemainingPercent: Percent,
+    weeklyRemainingPercent: Percent,
+    dailyResetAtMs: Percent,
+    weeklyResetAtMs: Percent,
+  }),
+});
+
+/** An unreadable or malformed file reads as no saved value and is not overwritten. Writes are replaced atomically within the same directory. */
+export function fileFusionSettings(path: string): FusionSettingsShape {
+  return {
+    read: Effect.map(readJsonFile(path, FusionFile), Option.match({
+      onNone: () => undefined,
+      onSome: (value): FusionSelection => ({ leadID: value.leadID, sidekickID: value.sidekickID }),
+    })),
+    write: (selection) => writeJsonFile(path, { schemaVersion: SCHEMA_VERSION, leadID: selection.leadID, sidekickID: selection.sidekickID }),
+  };
+}
+
+/** An unreadable or malformed file reads as the defaults and is not overwritten. Writes are replaced atomically within the same directory. */
+export function fileDisplaySettings(path: string): DisplaySettingsShape {
+  return {
+    read: Effect.map(readJsonFile(path, SettingsFile), Option.match({
+      onNone: () => ({ ...DEFAULT_PREFERENCES }),
+      onSome: (value) => ({ recommendedOnly: value.recommendedOnly, showUsageStatus: value.showUsageStatus }),
+    })),
+    write: (preferences) => writeJsonFile(path, { schemaVersion: SCHEMA_VERSION, ...preferences }),
+  };
+}
+
+/** An unreadable or malformed file reads as no record and is not repaired by reading. Writes are replaced atomically within the same directory. */
+export function fileUsageStore(path: string): UsageStoreShape {
+  const readRecord = readJsonFile(path, UsageRecord);
+  return {
+    read: (scope) => Effect.map(readRecord, (record) => Option.isSome(record) && record.value.scope === scope ? { ...record.value.usage } : undefined),
+    write: (scope, usage) => Effect.flatMap(readRecord, (current) => Option.isSome(current) && current.value.scope === scope && !isNotOlder(current.value.usage, usage)
+      ? Effect.void : writeJsonFile(path, { schemaVersion: SCHEMA_VERSION, scope, usage })),
+  };
+}
+
+export const FusionSettingsFile = (path: string) => Layer.succeed(FusionSettings, fileFusionSettings(path));
+export const DisplaySettingsFile = (path: string) => Layer.succeed(DisplaySettings, fileDisplaySettings(path));
+export const UsageStoreFile = (path: string) => Layer.succeed(UsageStore, fileUsageStore(path));

package/src/pi/adapters/storage/json-file.ts

@@ -0,0 +1,31 @@
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { Effect, Option, Schema } from "effect";
+import { toDevinError, type DevinError } from "../../../core/errors.ts";
+
+/*
+ * Pi reads these small global files from synchronous callbacks, such as TUI rendering and model list rebuilds,
+ * and other Pi processes may change them at any time. They are therefore read fresh and synchronously on each use;
+ * Effect's FileSystem service is asynchronous only.
+ */
+
+/** The file's value when it exists, parses and matches the schema. A missing or malformed file is never repaired by reading. */
+export function readJsonFile<S extends Schema.ConstraintDecoder<unknown>>(path: string, schema: S): Effect.Effect<Option.Option<S["Type"]>> {
+  const decode = Schema.decodeUnknownOption(schema);
+  return Effect.sync(() => {
+    try { return decode(JSON.parse(readFileSync(path, "utf8"))); } catch { return Option.none(); }
+  });
+}
+
+/** Replaces the file atomically within its directory. */
+export function writeJsonFile(path: string, value: unknown): Effect.Effect<void, DevinError> {
+  return Effect.try({
+    try: () => {
+      mkdirSync(dirname(path), { recursive: true });
+      const temporary = `${path}.${process.pid}.tmp`;
+      writeFileSync(temporary, JSON.stringify(value, null, 2) + "\n");
+      renameSync(temporary, path);
+    },
+    catch: toDevinError,
+  });
+}

package/src/pi/app/config.ts

@@ -0,0 +1,25 @@
+import { Context } from "effect";
+
+export interface LoginSettings {
+  apiServerURL?: string;
+  webappURL?: string;
+  devinAPIURL?: string;
+  timeoutMs?: number;
+}
+
+/** Values the entry point chooses for one extension instance. Read by the services that need them. */
+export interface ExtensionConfigShape {
+  /** Clock of quota timestamps and session check times. */
+  readonly now: () => number;
+  /**
+   * This Pi is the Fusion sidekick child: it lists every exact UID, builds no Fusion entry, ignores the recommended filter,
+   * and registers no sidekick tool, `/devin`, `/devin-fusion` or status line.
+   */
+  readonly isFusionChild: boolean;
+  /** Endpoints and the time limit of `/login`. */
+  readonly login: LoginSettings;
+  /** Pi agent directory that holds sidekick session files. Read when a handoff starts. */
+  readonly agentDir: () => string;
+}
+
+export class ExtensionConfig extends Context.Service<ExtensionConfig, ExtensionConfigShape>()("pi-devin/ExtensionConfig") {}

package/src/pi/app/environment.ts

@@ -0,0 +1,30 @@
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
+import { Layer } from "effect";
+import { NodeDeviceIdentitySource } from "../../core/services/device-identity.ts";
+import { NodeHttpTransport, nodeTransport } from "../../core/services/http-transport.ts";
+import { NodePlatformLayer } from "../../core/services/platform.ts";
+import { accountUsagePath, devinSettingsPath, DisplaySettingsFile, fusionSettingsPath, FusionSettingsFile, UsageStoreFile } from "../adapters/storage/files.ts";
+import { LoginTransport } from "../features/auth/login.ts";
+import { DisplaySettings, FusionSettings, memoryDisplaySettings, memoryFusionSettings } from "../features/settings/service.ts";
+import { NodeSidekickLauncher } from "../features/sidekick/launcher.ts";
+import { ExtensionConfig } from "./config.ts";
+import type { ExtensionEnvironment } from "./layer.ts";
+
+/**
+ * The environment Pi loads the extension with: Node's network, process and file services, and the global stores in Pi's agent directory.
+ * The sidekick child keeps no Fusion or display settings, but records its quota so the lead shows what the sidekick used.
+ */
+export function productionEnvironment(options: { isFusionChild: boolean }): Layer.Layer<ExtensionEnvironment> {
+  const agentDir = getAgentDir();
+  const settings = options.isFusionChild
+    ? Layer.mergeAll(Layer.sync(FusionSettings, () => memoryFusionSettings()), Layer.sync(DisplaySettings, () => memoryDisplaySettings()))
+    : Layer.mergeAll(FusionSettingsFile(fusionSettingsPath(agentDir)), DisplaySettingsFile(devinSettingsPath(agentDir)));
+  return Layer.mergeAll(
+    Layer.succeed(ExtensionConfig, { isFusionChild: options.isFusionChild, now: Date.now, login: {}, agentDir: getAgentDir }),
+    NodeHttpTransport(),
+    Layer.succeed(LoginTransport, nodeTransport()),
+    settings,
+    UsageStoreFile(accountUsagePath(agentDir)),
+    NodeSidekickLauncher,
+  ).pipe(Layer.provideMerge(Layer.mergeAll(NodeDeviceIdentitySource.pipe(Layer.provide(NodePlatformLayer)), NodePlatformLayer)));
+}

package/src/pi/app/layer.ts

@@ -0,0 +1,43 @@
+import { Layer, type FileSystem } from "effect";
+import type { DeviceIdentitySource } from "../../core/services/device-identity.ts";
+import type { HttpTransport } from "../../core/services/http-transport.ts";
+import { UsageStatusLive } from "../adapters/pi/usage-status.ts";
+import { AccountsLive } from "../features/accounts/service.ts";
+import { CredentialGuardLive } from "../features/auth/guard.ts";
+import { AccountLoginLive, type LoginTransport } from "../features/auth/login.ts";
+import { AuthStateLive } from "../features/auth/state.ts";
+import { RemoteCatalogLive } from "../features/catalog/remote.ts";
+import { ModelCatalogLive } from "../features/catalog/service.ts";
+import { DevinClientsLive } from "../features/clients/service.ts";
+import { InferenceLive } from "../features/inference/service.ts";
+import { ProviderLifetimeLive } from "../features/lifetime/service.ts";
+import { RunsLive } from "../features/runs/service.ts";
+import type { DisplaySettings, FusionSettings, UsageStore } from "../features/settings/service.ts";
+import type { SidekickLauncher } from "../features/sidekick/launcher.ts";
+import { SidekicksLive } from "../features/sidekick/service.ts";
+import { UsageChangesLive } from "../features/usage/changes.ts";
+import type { ExtensionConfig } from "./config.ts";
+
+/** What the entry point provides for the provider: its values and external I/O. */
+export type ProviderEnvironment = ExtensionConfig | HttpTransport | LoginTransport | DeviceIdentitySource | FusionSettings | DisplaySettings | UsageStore;
+/** The provider environment plus what the extension's host features need. */
+export type ExtensionEnvironment = ProviderEnvironment | SidekickLauncher | FileSystem.FileSystem;
+
+/** State owners that need no other feature. */
+const StateLive = Layer.mergeAll(ProviderLifetimeLive, AuthStateLive, UsageChangesLive, RunsLive);
+
+/**
+ * Features behind Pi's provider contract. Each layer receives the ones below it, so dependencies only point downward:
+ * requests and sign-in use the catalog, which uses the guard and accounts, which use clients and the state owners.
+ */
+export const ProviderLive = Layer.mergeAll(InferenceLive, AccountLoginLive).pipe(
+  Layer.provideMerge(ModelCatalogLive),
+  Layer.provideMerge(RemoteCatalogLive),
+  Layer.provideMerge(CredentialGuardLive),
+  Layer.provideMerge(AccountsLive),
+  Layer.provideMerge(DevinClientsLive),
+  Layer.provideMerge(StateLive),
+);
+
+/** The provider and the features that need Pi's host: the Fusion sidekick and the usage status line. */
+export const ExtensionLive = Layer.mergeAll(SidekicksLive, UsageStatusLive).pipe(Layer.provideMerge(ProviderLive));

package/src/pi/app/runtime.ts

@@ -0,0 +1,20 @@
+import { Layer, ManagedRuntime } from "effect";
+import type { DevinError } from "../../core/errors.ts";
+import type { SidekickHost } from "../features/sidekick/service.ts";
+import { ExtensionLive, ProviderLive, type ExtensionEnvironment, type ProviderEnvironment } from "./layer.ts";
+
+export type ProviderServices = Layer.Success<typeof ProviderLive> | ProviderEnvironment;
+export type ExtensionServices = Layer.Success<typeof ExtensionLive> | ExtensionEnvironment | SidekickHost;
+export type ProviderRuntime = ManagedRuntime.ManagedRuntime<ProviderServices, DevinError>;
+export type ExtensionRuntime = ManagedRuntime.ManagedRuntime<ExtensionServices, DevinError>;
+
+/**
+ * One runtime per extension instance. It is never disposed on `session_shutdown`: Pi may still call the same provider
+ * afterwards, and the next `session_start` reuses it with a new provider lifetime. Its layers hold no operating system
+ * resources; connection pools close with their clients and sidekick children with their sessions.
+ */
+export const makeProviderRuntime = (environment: Layer.Layer<ProviderEnvironment>): ProviderRuntime =>
+  ManagedRuntime.make(ProviderLive.pipe(Layer.provideMerge(environment)));
+
+export const makeExtensionRuntime = (environment: Layer.Layer<ExtensionEnvironment>, host: Layer.Layer<SidekickHost>): ExtensionRuntime =>
+  ManagedRuntime.make(ExtensionLive.pipe(Layer.provideMerge(Layer.mergeAll(environment, host))));

package/src/pi/app/session.ts

@@ -0,0 +1,26 @@
+import { Effect } from "effect";
+import { Cancelled } from "../../core/errors.ts";
+import { Accounts } from "../features/accounts/service.ts";
+import { DevinClients } from "../features/clients/service.ts";
+import { ProviderLifetime } from "../features/lifetime/service.ts";
+import { Runs } from "../features/runs/service.ts";
+import type { SessionBinding } from "../features/runs/types.ts";
+
+/** Binds the provider to Pi's current session: a new provider lifetime if the last one ended, then the session's stored run state. Fails on a corrupt state. */
+export const attachSession = (binding: SessionBinding) => Effect.gen(function* () {
+  yield* (yield* ProviderLifetime).renew;
+  yield* (yield* Runs).attach(binding);
+});
+
+/**
+ * Stops the provider's work. The lifetime ends first, so running requests stop with its reason rather than an interruption;
+ * an unfinished run stays in the session's checkpoint. The extension instance and its runtime stay usable.
+ */
+export const shutdownProvider = Effect.gen(function* () {
+  const clients = yield* DevinClients;
+  yield* (yield* ProviderLifetime).end(new Cancelled({ message: "The Devin provider shut down." }));
+  yield* (yield* Runs).shutdown;
+  yield* clients.closeAll;
+  yield* clients.clearFingerprints;
+  yield* (yield* Accounts).clear;
+});

package/src/pi/features/accounts/service.ts

@@ -0,0 +1,69 @@
+import { Context, Effect, Layer } from "effect";
+import type { Credential, JsonObject } from "../../../core/types.ts";
+import { requiredString } from "../../../core/validation.ts";
+import { ExtensionConfig } from "../../app/config.ts";
+import { AuthState } from "../auth/state.ts";
+import { evictOldest } from "../bounded.ts";
+import { catalogScope } from "../catalog/projection.ts";
+import { DevinClients } from "../clients/service.ts";
+import { ProviderLifetime } from "../lifetime/service.ts";
+import { UsageStore } from "../settings/service.ts";
+import { UsageChanges } from "../usage/changes.ts";
+import { accountUsage } from "../usage/report.ts";
+import type { AccountUsage } from "../usage/types.ts";
+import type { AccountRecord, AccountsShape } from "./types.ts";
+
+/**
+ * The only owner of the account status query (`GetUserStatus`): accounts this process verified, by credential scope,
+ * and the newest quota they reported. Request checks, the check after sign-in and the periodic session check all go through it.
+ */
+export class Accounts extends Context.Service<Accounts, AccountsShape>()("pi-devin/Accounts") {}
+
+export const AccountsLive = Layer.effect(Accounts, Effect.gen(function* () {
+  const clients = yield* DevinClients;
+  const store = yield* UsageStore;
+  const changes = yield* UsageChanges;
+  const lifetime = yield* ProviderLifetime;
+  const auth = yield* AuthState;
+  const config = yield* ExtensionConfig;
+  const records = new Map<string, AccountRecord>();
+  let latestUsage: { scope: string; usage: AccountUsage } | undefined;
+
+  // A stopped provider records nothing more.
+  const record = (credential: Credential, ownerHash: string, status: JsonObject) => Effect.gen(function* () {
+    if (!(yield* lifetime.isActive)) return;
+    const scope = catalogScope(credential);
+    evictOldest(records, 16);
+    records.set(scope, { ownerHash, status });
+    const usage = accountUsage(status, config.now());
+    latestUsage = { scope, usage };
+    // Subagents and the Fusion sidekick run in other processes; a failed write only loses sharing.
+    yield* Effect.ignore(store.write(scope, usage));
+    yield* changes.publish;
+  });
+
+  return {
+    get: (credential) => Effect.sync(() => records.get(catalogScope(credential))),
+    check: (credential, check) => Effect.scoped(Effect.gen(function* () {
+      const client = yield* clients.open(credential, { profile: "login", ...check.connection });
+      const status = yield* client.status();
+      if ((yield* auth.generation) !== check.expectedGeneration) return "stale" as const;
+      if (check.beforeRecord) yield* check.beforeRecord;
+      yield* record(credential, yield* requiredString(yield* client.accountIdentityHash, "Devin account scope"), status);
+      return "recorded" as const;
+    })),
+    forget: (credential) => Effect.sync(() => {
+      records.delete(catalogScope(credential));
+      latestUsage = undefined;
+    }),
+    clear: Effect.sync(() => {
+      records.clear();
+      latestUsage = undefined;
+    }),
+    usage: (scope) => Effect.map(store.read(scope), (shared) => {
+      const local = latestUsage?.scope === scope ? latestUsage.usage : undefined;
+      const newest = shared && (!local || shared.fetchedAtMs > local.fetchedAtMs) ? shared : local;
+      return newest ? { ...newest } : undefined;
+    }),
+  } satisfies AccountsShape;
+}));

package/src/pi/features/accounts/types.ts

@@ -0,0 +1,25 @@
+import type { Effect } from "effect";
+import type { DevinFailure } from "../../../core/errors.ts";
+import type { Credential, JsonObject } from "../../../core/types.ts";
+import type { AccountUsage } from "../usage/types.ts";
+
+export interface AccountRecord { ownerHash: string; status: JsonObject }
+
+export interface AccountCheck {
+  /** Sign-in generation the caller started in. When a newer sign-in started meanwhile, nothing is recorded. */
+  expectedGeneration: number;
+  /** Connection settings of the lookup, such as Pi's per-request fetch and time limit. */
+  connection?: { fetch?: typeof fetch; timeoutMs?: number };
+  /** Runs after the generation check and before recording. Its failure leaves the result unrecorded. */
+  beforeRecord?: Effect.Effect<void, DevinFailure>;
+}
+
+export interface AccountsShape {
+  readonly get: (credential: Credential) => Effect.Effect<AccountRecord | undefined>;
+  /** Looks up the account status and records it. `"stale"` when a newer sign-in started meanwhile. Failure policy belongs to the caller. */
+  readonly check: (credential: Credential, check: AccountCheck) => Effect.Effect<"recorded" | "stale", DevinFailure>;
+  readonly forget: (credential: Credential) => Effect.Effect<void>;
+  readonly clear: Effect.Effect<void>;
+  /** Newest quota for the scope, received here or by another process sharing the usage store. Makes no request. */
+  readonly usage: (scope: string) => Effect.Effect<AccountUsage | undefined>;
+}

package/src/pi/features/auth/credential.ts

@@ -0,0 +1,40 @@
+import { createHash } from "node:crypto";
+import type { OAuthCredential } from "@earendil-works/pi-ai";
+import { Effect } from "effect";
+import type { DevinError } from "../../../core/errors.ts";
+import { endpoint } from "../../../core/protocol/endpoint.ts";
+import type { Credential } from "../../../core/types.ts";
+import { failWith, object, requiredString } from "../../../core/validation.ts";
+
+export const OAUTH_ONLY_MESSAGE = "Devin uses only the OAuth account session from /login. API key authentication is not supported.";
+/**
+ * Pi checks the stored session again after this interval. It is not a server TTL: the server expiry is unknown, no new token
+ * is issued, and each model request still checks the account outside Pi's credential lock.
+ */
+export const SESSION_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+
+export function credentialFromOAuth(credential: OAuthCredential): Effect.Effect<Credential, DevinError> {
+  return Effect.gen(function* () {
+    // 0.1.4 and earlier stored `expires: 0`; Pi checks such a session again on its next use.
+    if (credential.type !== "oauth" || credential.refresh !== "" || !Number.isSafeInteger(credential.expires) || credential.expires < 0) {
+      return yield* failWith("Unsupported Devin account credential. Sign in again with /login.");
+    }
+    const metadata = yield* object(credential.devin, "Devin credential metadata");
+    if (metadata.version !== 1) return yield* failWith("The Devin account credential version differs. Sign in again with /login.");
+    return {
+      version: 1,
+      sessionToken: yield* requiredString(credential.access, "Devin credential access"),
+      apiServerURL: yield* endpoint(yield* requiredString(metadata.apiServerURL, "Devin credential API server")),
+      createdAt: yield* requiredString(metadata.createdAt, "Devin credential creation time"),
+    } satisfies Credential;
+  });
+}
+
+export function credentialKey(credential: Credential): string {
+  return createHash("sha256").update(credential.apiServerURL + "\0" + credential.sessionToken).digest("hex");
+}
+
+/** Endpoint mismatches are rejected separately by the model list scope. This only checks that the session came from OAuth. */
+export function sessionKey(credential: Credential): string {
+  return createHash("sha256").update(credential.sessionToken).digest("hex");
+}

package/src/pi/features/auth/guard.ts

@@ -0,0 +1,25 @@
+import { Context, Effect, Layer } from "effect";
+import { isAuthenticationError } from "../../../core/errors.ts";
+import { Accounts } from "../accounts/service.ts";
+import { Runs } from "../runs/service.ts";
+import { UsageChanges } from "../usage/changes.ts";
+import { AuthState } from "./state.ts";
+import type { CredentialGuardShape } from "./types.ts";
+
+/** Turns a confirmed authentication failure into its consequences, in order and within the reporting effect. */
+export class CredentialGuard extends Context.Service<CredentialGuard, CredentialGuardShape>()("pi-devin/CredentialGuard") {}
+
+export const CredentialGuardLive = Layer.effect(CredentialGuard, Effect.gen(function* () {
+  const auth = yield* AuthState;
+  const accounts = yield* Accounts;
+  const runs = yield* Runs;
+  const changes = yield* UsageChanges;
+  return {
+    reportFailure: (credential, error, generation) => Effect.gen(function* () {
+      if (!isAuthenticationError(error) || !(yield* auth.markInvalid(credential, error, generation))) return;
+      yield* accounts.forget(credential);
+      yield* runs.abort(error);
+      yield* changes.publish;
+    }),
+  } satisfies CredentialGuardShape;
+}));

package/src/pi/features/auth/login.ts

@@ -0,0 +1,116 @@
+import type { AuthInteraction, OAuthCredential } from "@earendil-works/pi-ai";
+import { Context, Duration, Effect, Layer } from "effect";
+import { loginAccount } from "../../../core/auth/login.ts";
+import { abortWith } from "../../../core/cancellation.ts";
+import { Cancelled, isTransientConnectionFailure, toDevinFailure } from "../../../core/errors.ts";
+import { HttpTransport, type HttpTransportShape } from "../../../core/services/http-transport.ts";
+import { failWith } from "../../../core/validation.ts";
+import { ExtensionConfig } from "../../app/config.ts";
+import { Accounts } from "../accounts/service.ts";
+import { ModelCatalog } from "../catalog/service.ts";
+import { DevinClients } from "../clients/service.ts";
+import { ProviderLifetime } from "../lifetime/service.ts";
+import { Runs } from "../runs/service.ts";
+import { UsageChanges } from "../usage/changes.ts";
+import { credentialFromOAuth, SESSION_CHECK_INTERVAL_MS } from "./credential.ts";
+import { CredentialGuard } from "./guard.ts";
+import { AuthState } from "./state.ts";
+import type { AccountLoginShape } from "./types.ts";
+
+/** Upper bound of the account check right after sign-in. Sign-in succeeds even when this check fails. */
+const LOGIN_CHECK_TIMEOUT_MS = 15_000;
+
+/** The transport of `/login` code exchanges, chosen by the environment like the provider's own transport. */
+export class LoginTransport extends Context.Service<LoginTransport, HttpTransportShape>()("pi-devin/LoginTransport") {}
+
+/** Pi's OAuth flows: sign-in, the periodic session check under Pi's credential lock, and request auth. */
+export class AccountLogin extends Context.Service<AccountLogin, AccountLoginShape>()("pi-devin/AccountLogin") {}
+
+/** A host prompt that is withdrawn, through its signal, when the waiting effect is interrupted. */
+const prompt = <A>(request: (signal: AbortSignal) => Promise<A>) => Effect.tryPromise({ try: request, catch: toDevinFailure });
+
+export const AccountLoginLive = Layer.effect(AccountLogin, Effect.gen(function* () {
+  const config = yield* ExtensionConfig;
+  const auth = yield* AuthState;
+  const accounts = yield* Accounts;
+  const guard = yield* CredentialGuard;
+  const catalog = yield* ModelCatalog;
+  const clients = yield* DevinClients;
+  const runs = yield* Runs;
+  const changes = yield* UsageChanges;
+  const lifetime = yield* ProviderLifetime;
+  const transport = yield* LoginTransport;
+  const now = config.now;
+
+  /** Stops the work when the caller's signal or the provider lifetime current at the start of the host call ends, failing with that reason. */
+  const stoppable = (signal: AbortSignal | undefined) => Effect.map(lifetime.current, (current) => <A, E>(effect: Effect.Effect<A, E>) =>
+    current.guard(effect).pipe(abortWith(signal)));
+
+  const signIn = (interaction: AuthInteraction) => Effect.gen(function* () {
+    const choice = yield* prompt((signal) => interaction.prompt({ type: "select", signal, message: "Devin account sign-in method", options: [
+      { id: "browser", label: "Browser sign-in", description: "Choose an account, then return through a loopback callback." },
+      { id: "manual", label: "Manual authorization code", description: "Enter a one-time code using the Devin CLI manual flow. This is not an API key prompt." },
+    ] }));
+    if (choice !== "browser" && choice !== "manual") return yield* failWith("Unsupported Devin sign-in method.");
+    const credential = yield* loginAccount({
+      ...config.login, flow: choice,
+      onURL: (url) => Effect.sync(() => interaction.notify({ type: "auth_url", url, instructions: "Return to the terminal after signing in. Signing in does not guarantee CLI access or quota." })),
+      promptCode: prompt((signal) => interaction.prompt({ type: "manual_code", message: "Paste the authorization code or callback URL. Do not enter an API key or session token.", signal })),
+    }).pipe(Effect.provideService(HttpTransport, transport));
+    return { choice, credential };
+  });
+
+  /** A new session replaces everything learned from the previous one, in this order, before its own account is checked. */
+  const replaceSession = Effect.all([
+    accounts.clear, clients.clearFingerprints, catalog.invalidate,
+    runs.abort(new Cancelled({ message: "The Devin account was re-authenticated." })), changes.publish,
+  ], { discard: true });
+
+  const login = (interaction: AuthInteraction) => Effect.gen(function* () {
+    const stop = yield* stoppable(interaction.signal);
+    const { choice, credential } = yield* stop(signIn(interaction));
+    const generation = yield* auth.acceptLogin(credential);
+    yield* replaceSession;
+    // Records the new session's account and quota so the same account's model list and usage are available at once.
+    // Sign-in is not a permission check: a failure here, including cancellation, is left to the first model request.
+    yield* stop(accounts.check(credential, { expectedGeneration: generation })).pipe(
+      Effect.timeoutOrElse({ duration: Duration.millis(LOGIN_CHECK_TIMEOUT_MS), orElse: () => Effect.void }),
+      Effect.ignore,
+    );
+    interaction.notify({ type: "info", message: "Signed in to the Devin account. The server expiry time and refresh grant are unknown. If authentication fails, sign in again with /login." });
+    return {
+      type: "oauth", access: credential.sessionToken, refresh: "", expires: now() + SESSION_CHECK_INTERVAL_MS,
+      devin: { version: 1, apiServerURL: credential.apiServerURL, createdAt: credential.createdAt, flow: choice },
+    } satisfies OAuthCredential;
+  });
+
+  const usableCredential = (current: OAuthCredential) => Effect.gen(function* () {
+    const credential = yield* credentialFromOAuth(current);
+    yield* auth.assertUsable(credential);
+    return yield* auth.rememberOAuth(credential);
+  });
+
+  const refresh = (current: OAuthCredential) => Effect.gen(function* () {
+    const credential = yield* usableCredential(current);
+    // Pi calls this while holding the shared auth.json lock once the check interval has passed, and saves the result.
+    // The new expiry only schedules the next check; the token is never renewed.
+    const checked = (): OAuthCredential => ({ ...current, expires: now() + SESSION_CHECK_INTERVAL_MS });
+    // Model requests already check the account outside the lock, so a process that checked it does not wait on the network.
+    if (yield* accounts.get(credential)) return checked();
+    const expectedGeneration = yield* auth.generation;
+    return yield* accounts.check(credential, { expectedGeneration }).pipe(
+      Effect.map(checked),
+      Effect.catch((error) => Effect.andThen(guard.reportFailure(credential, error, expectedGeneration),
+        // An unreachable check must not block the request: keep the stored session unchanged so the model request
+        // succeeds or reports its own retryable transport error, and the next use checks again.
+        isTransientConnectionFailure(error) ? Effect.succeed(current) : Effect.fail(error))),
+    );
+  });
+
+  return {
+    login,
+    refresh: (current, signal) => Effect.flatMap(stoppable(signal), (stop) => stop(refresh(current))),
+    // apiKey is only ModelAuth's transport field; the sign-in/storage auth type is always oauth.
+    toAuth: (current) => Effect.map(usableCredential(current), (credential) => ({ apiKey: credential.sessionToken, baseUrl: credential.apiServerURL })),
+  } satisfies AccountLoginShape;
+}));

package/src/pi/features/auth/state.ts

@@ -0,0 +1,48 @@
+import { Context, Effect, Layer } from "effect";
+import { isAuthenticationError, RPCError } from "../../../core/errors.ts";
+import type { Credential } from "../../../core/types.ts";
+import { failWith } from "../../../core/validation.ts";
+import { evictOldest } from "../bounded.ts";
+import { credentialFromOAuth, credentialKey, OAUTH_ONLY_MESSAGE, sessionKey } from "./credential.ts";
+import type { AuthStateShape } from "./types.ts";
+
+/**
+ * Whether a credential may be used: the sign-in generation, credentials invalidated by a confirmed 401,
+ * and the OAuth sessions this process has seen. Remembers only hashes, never a token.
+ */
+export class AuthState extends Context.Service<AuthState, AuthStateShape>()("pi-devin/AuthState") {}
+
+export const AuthStateLive = Layer.sync(AuthState, () => {
+  const invalid = new Set<string>();
+  const oauthSessions = new Set<string>();
+  let generation = 0;
+  const rememberOAuth = (credential: Credential) => Effect.sync(() => {
+    const key = sessionKey(credential);
+    oauthSessions.delete(key);
+    evictOldest(oauthSessions, 64);
+    oauthSessions.add(key);
+    return credential;
+  });
+  return {
+    generation: Effect.sync(() => generation),
+    assertUsable: (credential) => Effect.suspend(() => invalid.has(credentialKey(credential))
+      ? Effect.fail(RPCError.make("unauthenticated", "Authentication failed for this session. Sign in again with /login.")) : Effect.void),
+    // Kept as a plain error so it does not invalidate authentication or cancel a running request.
+    assertOAuthSession: (credential) => Effect.suspend(() => oauthSessions.has(sessionKey(credential)) ? Effect.void : failWith(OAUTH_ONLY_MESSAGE)),
+    rememberOAuth,
+    fromHost: (credential) => Effect.flatMap(credentialFromOAuth(credential), rememberOAuth),
+    markInvalid: (credential, error, expectedGeneration) => Effect.sync(() => {
+      if (expectedGeneration !== generation || !isAuthenticationError(error)) return false;
+      const key = credentialKey(credential);
+      if (invalid.has(key)) return false;
+      evictOldest(invalid, 64);
+      invalid.add(key);
+      return true;
+    }),
+    acceptLogin: (credential) => Effect.gen(function* () {
+      invalid.delete(credentialKey(credential));
+      yield* rememberOAuth(credential);
+      return ++generation;
+    }),
+  } satisfies AuthStateShape;
+});

package/src/pi/features/auth/types.ts

@@ -0,0 +1,36 @@
+import type { AuthInteraction, ModelAuth, OAuthCredential } from "@earendil-works/pi-ai";
+import type { Effect } from "effect";
+import type { DevinError, DevinFailure, RPCError } from "../../../core/errors.ts";
+import type { Credential } from "../../../core/types.ts";
+
+export interface AuthStateShape {
+  /** Increases with every successful sign-in. Work captures it when it starts and acts on failures only within the same generation. */
+  readonly generation: Effect.Effect<number>;
+  /** Fails with an authentication error when this credential was invalidated. */
+  readonly assertUsable: (credential: Credential) => Effect.Effect<void, RPCError>;
+  /** Rejects sessions that did not come from an OAuth login or stored credential (API keys etc.) before any network request. */
+  readonly assertOAuthSession: (credential: Credential) => Effect.Effect<void, DevinError>;
+  /** Remembers the credential as this process's OAuth session. Pi resolves the session in use on every request, so it moves back to the front. */
+  readonly rememberOAuth: (credential: Credential) => Effect.Effect<Credential>;
+  /** Converts the OAuth credential stored by Pi into the shared credential and remembers it as an OAuth session. */
+  readonly fromHost: (credential: OAuthCredential) => Effect.Effect<Credential, DevinError>;
+  /** Marks a confirmed authentication failure of the given generation. True only when this call invalidated the credential. */
+  readonly markInvalid: (credential: Credential, error: unknown, generation: number) => Effect.Effect<boolean>;
+  /** A new sign-in: clears its invalid mark, remembers it and starts the next generation, which it returns. */
+  readonly acceptLogin: (credential: Credential) => Effect.Effect<number>;
+}
+
+export interface CredentialGuardShape {
+  /**
+   * Acts on a failure seen while using the credential. Only a confirmed authentication failure of the current generation
+   * invalidates it; then its account record is forgotten and the running run stops with the same error. The credential file is never deleted.
+   */
+  readonly reportFailure: (credential: Credential, error: unknown, generation: number) => Effect.Effect<void>;
+}
+
+/** Pi's OAuth flows. Each call stops with the provider lifetime current when it started and with the caller's signal. */
+export interface AccountLoginShape {
+  readonly login: (interaction: AuthInteraction) => Effect.Effect<OAuthCredential, DevinFailure>;
+  readonly refresh: (current: OAuthCredential, signal: AbortSignal) => Effect.Effect<OAuthCredential, DevinFailure>;
+  readonly toAuth: (current: OAuthCredential) => Effect.Effect<ModelAuth, DevinError | RPCError>;
+}

package/src/pi/features/bounded.ts

@@ -0,0 +1,4 @@
+/** Makes room in an insertion-ordered set or map by forgetting its oldest entry once it holds `limit` entries. */
+export function evictOldest<T>(collection: Set<T> | Map<T, unknown>, limit: number): void {
+  if (collection.size >= limit) collection.delete(collection.keys().next().value!);
+}

package/src/pi/features/catalog/constants.ts

@@ -0,0 +1,10 @@
+import type { DevinAPI } from "./types.ts";
+
+export const DEVIN_API: DevinAPI = "devin-connect";
+export const CATALOG_VERSION = 1;
+/** Default sidekick when nothing is saved or the saved one is gone. The default lead is the group this UID belongs to. */
+export const FUSION_SIDEKICK_UID = "swe-2-medium";
+/** The single Fusion entry shown in `/model`. Lead and sidekick follow the global `/devin-fusion` choice. */
+export const FUSION_MODEL_ID = "fusion";
+
+export function isFusionModelID(id: string): boolean { return id === FUSION_MODEL_ID; }