devrites 5.10.2 → 5.12.0

package/engine/internal/hostpack/hostpack.go

@@ -18,10 +18,12 @@ const (
 	CodexSkillsTarget     = devritespaths.CodexSkillsTarget
 	OmpSkillsTarget       = devritespaths.OmpSkillsTarget
 	PiSkillsTarget        = devritespaths.PiSkillsTarget
+	DevinSkillsTarget     = devritespaths.DevinSkillsTarget
 	ClaudeAgentsTarget    = devritespaths.ClaudeAgentsTarget
 	CodexAgentsTarget     = devritespaths.CodexAgentsTarget
 	OmpAgentsTarget       = devritespaths.OmpAgentsTarget
 	PiAgentsTarget        = devritespaths.PiAgentsTarget
+	DevinAgentsTarget     = devritespaths.DevinAgentsTarget
 	PiPromptsTarget       = devritespaths.PiPromptsTarget
 	ClaudeWorkflowsTarget = devritespaths.ClaudeWorkflowsTarget
 )
@@ -99,6 +101,15 @@ var PiAgentsMerge = MarkerMerge{
 	MarkerText: "AGENTS.md contains a DevRites managed block between BEGIN/END DEVRITES PI markers.",
 }
 
+var DevinAgentsMerge = MarkerMerge{
+	TargetRel:  "AGENTS.md",
+	PayloadRel: "devin/AGENTS.md",
+	Begin:      "<!-- BEGIN DEVRITES DEVIN -->",
+	End:        "<!-- END DEVRITES DEVIN -->",
+	MarkerRel:  ".claude/devrites.devin-agents-merge",
+	MarkerText: "AGENTS.md contains a DevRites managed block between BEGIN/END DEVRITES DEVIN markers.",
+}
+
 var CodexConfigMerge = MarkerMerge{
 	TargetRel:  ".codex/config.toml",
 	PayloadRel: "codex/config.toml",
@@ -129,6 +140,13 @@ var managedMerges = []ManagedMerge{
 		End:       PiAgentsMerge.End,
 		DryRun:    "AGENTS.md DevRites pi block",
 	},
+	{
+		MarkerRel: DevinAgentsMerge.MarkerRel,
+		TargetRel: DevinAgentsMerge.TargetRel,
+		Begin:     DevinAgentsMerge.Begin,
+		End:       DevinAgentsMerge.End,
+		DryRun:    "AGENTS.md DevRites Devin block",
+	},
 	{
 		MarkerRel: CodexConfigMerge.MarkerRel,
 		TargetRel: CodexConfigMerge.TargetRel,
@@ -144,7 +162,7 @@ var managedMerges = []ManagedMerge{
 	LegacyCodexHooksMerge,
 }
 
-func RequiredPayload(withCodex, withOmp, withPi bool) []string {
+func RequiredPayload(withCodex, withOmp, withPi, withDevin bool) []string {
 	required := []string{
 		"claude/skills",
 		"claude/agents",
@@ -174,11 +192,18 @@ func RequiredPayload(withCodex, withOmp, withPi bool) []string {
 			"pi/AGENTS.md",
 		)
 	}
+	if withDevin {
+		required = append(required,
+			"devin/skills",
+			"devin/agents",
+			"devin/AGENTS.md",
+		)
+	}
 	return required
 }
 
-func ValidatePayload(payload fs.FS, withCodex, withOmp, withPi bool) error {
-	for _, rel := range RequiredPayload(withCodex, withOmp, withPi) {
+func ValidatePayload(payload fs.FS, withCodex, withOmp, withPi, withDevin bool) error {
+	for _, rel := range RequiredPayload(withCodex, withOmp, withPi, withDevin) {
 		if _, err := fs.Stat(payload, rel); err != nil {
 			return fmt.Errorf("missing %s", rel)
 		}
@@ -186,7 +211,7 @@ func ValidatePayload(payload fs.FS, withCodex, withOmp, withPi bool) error {
 	return nil
 }
 
-func InstallTrees(withSkills, withAgents, withCodex, withOmp, withPi bool) []Tree {
+func InstallTrees(withSkills, withAgents, withCodex, withOmp, withPi, withDevin bool) []Tree {
 	var trees []Tree
 	if withSkills {
 		trees = append(trees, Tree{PayloadPrefix: "claude/skills", TargetPrefix: ClaudeSkillsTarget})
@@ -202,6 +227,9 @@ func InstallTrees(withSkills, withAgents, withCodex, withOmp, withPi bool) []Tre
 				Tree{PayloadPrefix: "pi/prompts", TargetPrefix: PiPromptsTarget},
 			)
 		}
+		if withDevin {
+			trees = append(trees, Tree{PayloadPrefix: "devin/skills", TargetPrefix: DevinSkillsTarget})
+		}
 	}
 	if withAgents {
 		trees = append(trees, Tree{PayloadPrefix: "claude/agents", TargetPrefix: ClaudeAgentsTarget})
@@ -214,6 +242,9 @@ func InstallTrees(withSkills, withAgents, withCodex, withOmp, withPi bool) []Tre
 		if withPi {
 			trees = append(trees, Tree{PayloadPrefix: "pi/agents", TargetPrefix: PiAgentsTarget})
 		}
+		if withDevin {
+			trees = append(trees, Tree{PayloadPrefix: "devin/agents", TargetPrefix: DevinAgentsTarget})
+		}
 	}
 	if withSkills && withAgents {
 		trees = append(trees, Tree{PayloadPrefix: "claude/workflows", TargetPrefix: ClaudeWorkflowsTarget})
@@ -221,7 +252,7 @@ func InstallTrees(withSkills, withAgents, withCodex, withOmp, withPi bool) []Tre
 	return trees
 }
 
-func AliasTargets(alias Alias, withCodex, withOmp, withPi bool) []string {
+func AliasTargets(alias Alias, withCodex, withOmp, withPi, withDevin bool) []string {
 	targets := []string{filepath.ToSlash(filepath.Join(ClaudeSkillsTarget, alias.Name, "SKILL.md"))}
 	if withCodex {
 		targets = append(targets, filepath.ToSlash(filepath.Join(CodexSkillsTarget, alias.Name, "SKILL.md")))
@@ -232,6 +263,9 @@ func AliasTargets(alias Alias, withCodex, withOmp, withPi bool) []string {
 	if withPi {
 		targets = append(targets, filepath.ToSlash(filepath.Join(PiSkillsTarget, alias.Name, "SKILL.md")))
 	}
+	if withDevin {
+		targets = append(targets, filepath.ToSlash(filepath.Join(DevinSkillsTarget, alias.Name, "SKILL.md")))
+	}
 	return targets
 }
 

package/engine/internal/hostpack/hostpack_test.go

@@ -25,81 +25,95 @@ func TestValidatePayloadRequiresClaudeAndCodexFiles(t *testing.T) {
 		"pi/agents/devrites-code-reviewer.md":          {},
 		"pi/prompts/rite.md":                           {},
 		"pi/AGENTS.md":                                 {},
+		"devin/skills/rite/SKILL.md":                   {},
+		"devin/agents/devrites-code-reviewer.md":       {},
+		"devin/AGENTS.md":                              {},
 	}
-	if err := ValidatePayload(payload, true, true, true); err != nil {
+	if err := ValidatePayload(payload, true, true, true, true); err != nil {
 		t.Fatal(err)
 	}
 	delete(payload, "codex/config.toml")
-	err := ValidatePayload(payload, true, true, true)
+	err := ValidatePayload(payload, true, true, true, true)
 	if err == nil || !strings.Contains(err.Error(), "missing codex/config.toml") {
 		t.Fatalf("ValidatePayload error = %v, want missing codex/config.toml", err)
 	}
-	if err := ValidatePayload(payload, false, true, true); err != nil {
+	if err := ValidatePayload(payload, false, true, true, true); err != nil {
 		t.Fatalf("claude-only payload should not require codex files: %v", err)
 	}
 	delete(payload, "omp/.omp-plugin/plugin.json")
-	err = ValidatePayload(payload, false, true, true)
+	err = ValidatePayload(payload, false, true, true, true)
 	if err == nil || !strings.Contains(err.Error(), "missing omp/.omp-plugin/plugin.json") {
 		t.Fatalf("ValidatePayload error = %v, want missing omp/.omp-plugin/plugin.json", err)
 	}
 	delete(payload, "pi/prompts/rite.md")
-	err = ValidatePayload(payload, false, false, true)
+	err = ValidatePayload(payload, false, false, true, true)
 	if err == nil || !strings.Contains(err.Error(), "missing pi/prompts") {
 		t.Fatalf("ValidatePayload error = %v, want missing pi/prompts", err)
 	}
-	if err := ValidatePayload(payload, false, false, false); err != nil {
-		t.Fatalf("claude-only payload should not require omp or pi files: %v", err)
+	delete(payload, "devin/AGENTS.md")
+	err = ValidatePayload(payload, false, false, false, true)
+	if err == nil || !strings.Contains(err.Error(), "missing devin/AGENTS.md") {
+		t.Fatalf("ValidatePayload error = %v, want missing devin/AGENTS.md", err)
+	}
+	if err := ValidatePayload(payload, false, false, false, false); err != nil {
+		t.Fatalf("claude-only payload should not require omp, pi, or devin files: %v", err)
 	}
 }
 
 func TestInstallTreesMapPayloadsToTargets(t *testing.T) {
-	got := InstallTrees(true, true, true, true, true)
+	got := InstallTrees(true, true, true, true, true, true)
 	want := []Tree{
 		{PayloadPrefix: "claude/skills", TargetPrefix: ".claude/skills"},
 		{PayloadPrefix: "codex/skills", TargetPrefix: ".agents/skills"},
 		{PayloadPrefix: "omp/skills", TargetPrefix: ".omp/skills"},
 		{PayloadPrefix: "pi/skills", TargetPrefix: ".pi/skills"},
 		{PayloadPrefix: "pi/prompts", TargetPrefix: ".pi/prompts"},
+		{PayloadPrefix: "devin/skills", TargetPrefix: ".devin/skills"},
 		{PayloadPrefix: "claude/agents", TargetPrefix: ".claude/agents"},
 		{PayloadPrefix: "codex/agents", TargetPrefix: ".codex/agents"},
 		{PayloadPrefix: "omp/agents", TargetPrefix: ".omp/agents"},
 		{PayloadPrefix: "pi/agents", TargetPrefix: ".pi/agents"},
+		{PayloadPrefix: "devin/agents", TargetPrefix: ".devin/agents"},
 		{PayloadPrefix: "claude/workflows", TargetPrefix: ".claude/workflows"},
 	}
 	if !reflect.DeepEqual(got, want) {
 		t.Fatalf("InstallTrees() = %#v, want %#v", got, want)
 	}
-	for _, trees := range [][]Tree{InstallTrees(true, false, true, true, true), InstallTrees(false, true, true, true, true)} {
+	for _, trees := range [][]Tree{InstallTrees(true, false, true, true, true, true), InstallTrees(false, true, true, true, true, true)} {
 		for _, tree := range trees {
 			if tree.PayloadPrefix == "claude/workflows" {
 				t.Fatal("Claude workflow installed without both skills and agents")
 			}
 		}
 	}
-	for _, tree := range InstallTrees(true, true, true, false, false) {
+	for _, tree := range InstallTrees(true, true, true, false, false, false) {
 		if strings.HasPrefix(tree.TargetPrefix, ".omp/") {
 			t.Fatalf("omp tree installed with withOmp=false: %#v", tree)
 		}
 		if strings.HasPrefix(tree.TargetPrefix, ".pi/") {
 			t.Fatalf("pi tree installed with withPi=false: %#v", tree)
 		}
+		if strings.HasPrefix(tree.TargetPrefix, ".devin/") {
+			t.Fatalf("devin tree installed with withDevin=false: %#v", tree)
+		}
 	}
 }
 
 func TestAliasTargetsIncludeOmpWhenEnabled(t *testing.T) {
-	got := AliasTargets(Alias{Name: "define"}, true, true, true)
+	got := AliasTargets(Alias{Name: "define"}, true, true, true, true)
 	want := []string{
 		".claude/skills/define/SKILL.md",
 		".agents/skills/define/SKILL.md",
 		".omp/skills/define/SKILL.md",
 		".pi/skills/define/SKILL.md",
+		".devin/skills/define/SKILL.md",
 	}
 	if !reflect.DeepEqual(got, want) {
 		t.Fatalf("AliasTargets() = %#v, want %#v", got, want)
 	}
-	got = AliasTargets(Alias{Name: "define"}, true, false, false)
+	got = AliasTargets(Alias{Name: "define"}, true, false, false, false)
 	for _, rel := range got {
-		if strings.HasPrefix(rel, ".omp/") || strings.HasPrefix(rel, ".pi/") {
+		if strings.HasPrefix(rel, ".omp/") || strings.HasPrefix(rel, ".pi/") || strings.HasPrefix(rel, ".devin/") {
 			t.Fatalf("disabled-host alias installed: %s", rel)
 		}
 	}

package/engine/internal/install/apply.go

@@ -25,6 +25,7 @@ func (r *runner) install() error {
 	fmt.Fprintf(r.opts.Stdout, "  codex  : %s\n", yesno(r.opts.WithCodex))
 	fmt.Fprintf(r.opts.Stdout, "  omp    : %s\n", yesno(r.opts.WithOmp))
 	fmt.Fprintf(r.opts.Stdout, "  pi     : %s\n", yesno(r.opts.WithPi))
+	fmt.Fprintf(r.opts.Stdout, "  devin  : %s\n", yesno(r.opts.WithDevin))
 	fmt.Fprintf(r.opts.Stdout, "  aliases: %s\n", r.opts.AliasMode)
 	if r.opts.DryRun {
 		fmt.Fprintln(r.opts.Stdout, "  (dry run - no changes will be made)")
@@ -39,7 +40,7 @@ func (r *runner) install() error {
 		return err
 	}
 
-	for _, tree := range hostpack.InstallTrees(r.opts.WithSkills, r.opts.WithAgents, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi) {
+	for _, tree := range hostpack.InstallTrees(r.opts.WithSkills, r.opts.WithAgents, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi, r.opts.WithDevin) {
 		if err := r.installTree(tree.PayloadPrefix, tree.TargetPrefix); err != nil {
 			return fmt.Errorf("install tree %s: %w", tree.TargetPrefix, err)
 		}
@@ -50,7 +51,7 @@ func (r *runner) install() error {
 			if err != nil {
 				return fmt.Errorf("render alias skill %s: %w", alias.Name, err)
 			}
-			for _, rel := range hostpack.AliasTargets(alias, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi) {
+			for _, rel := range hostpack.AliasTargets(alias, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi, r.opts.WithDevin) {
 				if err := r.installData(data, rel); err != nil {
 					return fmt.Errorf("install alias: %w", err)
 				}
@@ -70,6 +71,11 @@ func (r *runner) install() error {
 			return fmt.Errorf("merge %s: %w", hostpack.PiAgentsMerge.TargetRel, err)
 		}
 	}
+	if r.opts.WithSkills && r.opts.WithDevin {
+		if err := r.mergeMarkerFile(hostpack.DevinAgentsMerge); err != nil {
+			return fmt.Errorf("merge %s: %w", hostpack.DevinAgentsMerge.TargetRel, err)
+		}
+	}
 	if r.opts.WithSkills {
 		if err := r.seedClaudeSettings(); err != nil {
 			return fmt.Errorf("seed claude settings: %w", err)
@@ -98,11 +104,15 @@ func (r *runner) install() error {
 	}
 	fmt.Fprintf(r.opts.Stdout, "  installed: %d   overwritten: %d   skipped(conflict): %d   pruned: %d\n", r.stats.installed, r.stats.overwrote, r.stats.skipped, r.stats.pruned)
 	if !r.opts.DryRun && r.opts.WithSkills {
+		claudeHosts := "Claude"
+		if r.opts.WithDevin {
+			claudeHosts = "Claude/Devin"
+		}
 		switch {
 		case r.opts.WithCodex && (r.opts.WithOmp || r.opts.WithPi):
-			fmt.Fprintln(r.opts.Stdout, "Next: reopen the project, then run /rite (Claude) or $rite (Codex) or /skill:rite (omp/pi).")
+			fmt.Fprintf(r.opts.Stdout, "Next: reopen the project, then run /rite (%s) or $rite (Codex) or /skill:rite (omp/pi).\n", claudeHosts)
 		case r.opts.WithCodex:
-			fmt.Fprintln(r.opts.Stdout, "Next: reopen the project, then run /rite (Claude) or $rite (Codex).")
+			fmt.Fprintf(r.opts.Stdout, "Next: reopen the project, then run /rite (%s) or $rite (Codex).\n", claudeHosts)
 		case r.opts.WithOmp || r.opts.WithPi:
 			fmt.Fprintln(r.opts.Stdout, "Next: reopen the project, then run /rite or /skill:rite.")
 		default:
@@ -320,6 +330,9 @@ func (r *runner) flagsString() string {
 	if !r.opts.WithPi {
 		flags = append(flags, "--no-pi")
 	}
+	if !r.opts.WithDevin {
+		flags = append(flags, "--no-devin")
+	}
 	if !r.opts.WithBinary {
 		flags = append(flags, "--no-binary")
 	}

package/engine/internal/install/install.go

@@ -36,6 +36,7 @@ type Options struct {
 	WithCodex   bool
 	WithOmp     bool
 	WithPi      bool
+	WithDevin   bool
 	WithBinary  bool
 	KeepBinary  bool
 	AliasMode   string
@@ -86,6 +87,7 @@ func DefaultOptions(mode Mode) Options {
 		WithCodex:  true,
 		WithOmp:    true,
 		WithPi:     true,
+		WithDevin:  true,
 		WithBinary: true,
 		AliasMode:  "safe",
 		Stdout:     io.Discard,
@@ -138,6 +140,7 @@ func parseArgs(args []string, opts *Options) error {
 	noCodex := flags.Bool("no-codex", !opts.WithCodex, "")
 	noOmp := flags.Bool("no-omp", !opts.WithOmp, "")
 	noPi := flags.Bool("no-pi", !opts.WithPi, "")
+	noDevin := flags.Bool("no-devin", !opts.WithDevin, "")
 	noAgents := flags.Bool("no-agents", !opts.WithAgents, "")
 	noSkills := flags.Bool("no-skills", !opts.WithSkills, "")
 	noBinary := flags.Bool("no-binary", !opts.WithBinary, "")
@@ -166,6 +169,7 @@ func parseArgs(args []string, opts *Options) error {
 	opts.WithCodex = !*noCodex
 	opts.WithOmp = !*noOmp
 	opts.WithPi = !*noPi
+	opts.WithDevin = !*noDevin
 	opts.WithAgents = !*noAgents
 	opts.WithSkills = !*noSkills
 	opts.WithBinary = !*noBinary
@@ -212,7 +216,7 @@ func usage(mode Mode) string {
 	case ModeUpdate:
 		return "usage: devrites-engine update [--target DIR] [--dry-run] [--force] [--check] [install flags] [--source-dir DIR --payload-dir DIR]\n"
 	default:
-		return "usage: devrites-engine install [--target DIR] [--dry-run] [--force] [--no-codex] [--no-omp] [--no-pi] [--no-agents] [--no-skills] [--no-binary] [--short-aliases=all]\n"
+		return "usage: devrites-engine install [--target DIR] [--dry-run] [--force] [--no-codex] [--no-omp] [--no-pi] [--no-devin] [--no-agents] [--no-skills] [--no-binary] [--short-aliases=all]\n"
 	}
 }
 
@@ -236,7 +240,13 @@ func Apply(opts Options) error {
 	if opts.Mode == ModeUninstall {
 		return r.uninstall()
 	}
-	return r.install()
+	if err := r.install(); err != nil {
+		return err
+	}
+	if !opts.DryRun {
+		reportStaleWorkspaces(opts.Stdout, r.target)
+	}
+	return nil
 }
 
 func newRunner(opts Options) (*runner, error) {
@@ -337,7 +347,7 @@ func (r *runner) validatePayload() error {
 	if r.payload == "" {
 		return fmt.Errorf("generated install payload not found; pass --payload-dir or run scripts/build-host-artifacts.sh")
 	}
-	if err := hostpack.ValidatePayload(r.payloadFS, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi); err != nil {
+	if err := hostpack.ValidatePayload(r.payloadFS, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi, r.opts.WithDevin); err != nil {
 		return fmt.Errorf("generated install payload under %s: %w", r.payload, err)
 	}
 	return nil
@@ -355,6 +365,9 @@ func isGlobalTarget(target string) bool {
 		filepath.Join(home, ".omp", "agent"),
 		filepath.Join(home, ".pi"),
 		filepath.Join(home, ".pi", "agent"),
+		filepath.Join(home, ".devin"),
+		filepath.Join(home, ".config", "devin"),
+		filepath.Join(home, ".agents"),
 	} {
 		if target == global || strings.HasPrefix(target, global+string(os.PathSeparator)) {
 			return true

package/engine/internal/install/install_test.go

@@ -54,12 +54,15 @@ func TestInstallPrintsFirstMoveForInstalledHosts(t *testing.T) {
 		withCodex bool
 		withOmp   bool
 		withPi    bool
+		withDevin bool
 		want      string
 	}{
 		{name: "Claude, Codex, and OMP", withCodex: true, withOmp: true, want: "Next: reopen the project, then run /rite (Claude) or $rite (Codex) or /skill:rite (omp/pi)."},
 		{name: "Claude and Codex", withCodex: true, withOmp: false, withPi: false, want: "Next: reopen the project, then run /rite (Claude) or $rite (Codex)."},
+		{name: "Claude, Codex, and Devin", withCodex: true, withDevin: true, want: "Next: reopen the project, then run /rite (Claude/Devin) or $rite (Codex)."},
 		{name: "Claude and OMP", withCodex: false, withOmp: true, withPi: false, want: "Next: reopen the project, then run /rite or /skill:rite."},
 		{name: "Claude and pi", withCodex: false, withOmp: false, withPi: true, want: "Next: reopen the project, then run /rite or /skill:rite."},
+		{name: "Claude and Devin", withCodex: false, withDevin: true, want: "Next: reopen the project, then run /rite."},
 		{name: "Claude only", withCodex: false, withOmp: false, withPi: false, want: "Next: reopen the project, then run /rite."},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
@@ -70,6 +73,7 @@ func TestInstallPrintsFirstMoveForInstalledHosts(t *testing.T) {
 			opts.WithCodex = tc.withCodex
 			opts.WithOmp = tc.withOmp
 			opts.WithPi = tc.withPi
+			opts.WithDevin = tc.withDevin
 			opts.Stdout = &out
 			opts.Stderr = &bytes.Buffer{}
 
@@ -125,6 +129,9 @@ func TestMarkerMergeAndUninstallPreserveUserContent(t *testing.T) {
 	if strings.Count(agents, "<!-- BEGIN DEVRITES CODEX -->") != 1 {
 		t.Fatalf("AGENTS marker duplicated:\n%s", agents)
 	}
+	if strings.Count(agents, "<!-- BEGIN DEVRITES DEVIN -->") != 1 {
+		t.Fatalf("AGENTS Devin marker missing or duplicated:\n%s", agents)
+	}
 	if !strings.Contains(agents, "user guidance") {
 		t.Fatal("AGENTS user content lost")
 	}
@@ -139,9 +146,12 @@ func TestMarkerMergeAndUninstallPreserveUserContent(t *testing.T) {
 	}
 
 	runUninstall(t, target)
-	if got := testutil.ReadFile(t, filepath.Join(target, "AGENTS.md")); !strings.Contains(got, "user guidance") || strings.Contains(got, "DEVRITES CODEX") {
+	if got := testutil.ReadFile(t, filepath.Join(target, "AGENTS.md")); !strings.Contains(got, "user guidance") || strings.Contains(got, "DEVRITES CODEX") || strings.Contains(got, "DEVRITES DEVIN") {
 		t.Fatalf("AGENTS uninstall preservation wrong:\n%s", got)
 	}
+	if exists(filepath.Join(target, ".devin")) {
+		t.Fatal("uninstall left .devin behind")
+	}
 	if got := testutil.ReadFile(t, filepath.Join(target, ".codex", "config.toml")); !strings.Contains(got, `model = "x"`) || strings.Contains(got, "DEVRITES CODEX") {
 		t.Fatalf("config uninstall preservation wrong:\n%s", got)
 	}
@@ -207,7 +217,7 @@ func TestInstallMergesClaudePermissionsIntoExistingSettings(t *testing.T) {
   "statusLine": {"type":"command","command":"DEVRITES_THEME=dark echo user-status"},
   "permissions": {
     "defaultMode": "plan",
-    "allow": ["Bash(user-tool *)"],
+    "allow": ["Bash(user-tool *)", "Bash(git checkout *)", "Bash(devrites-engine retired-cmd *)"],
     "ask": ["Bash(rm *)"]
   },
   "hooks": {"Stop":[{"hooks":[
@@ -221,7 +231,7 @@ func TestInstallMergesClaudePermissionsIntoExistingSettings(t *testing.T) {
 	runInstall(t, target, payload, func(o *Options) { o.Stderr = &stderr })
 
 	settings := testutil.ReadFile(t, filepath.Join(target, ".claude", "settings.json"))
-	for _, preserved := range []string{"keep my local notes", `"theme": "dark"`, "echo user-status", "echo user-stop", "Bash(user-tool *)", "Bash(rm *)"} {
+	for _, preserved := range []string{"keep my local notes", `"theme": "dark"`, "echo user-status", "echo user-stop", "Bash(user-tool *)", "Bash(git checkout *)", "Bash(rm *)"} {
 		if !strings.Contains(settings, preserved) {
 			t.Fatalf("Claude settings lost user content %q:\n%s", preserved, settings)
 		}
@@ -229,6 +239,14 @@ func TestInstallMergesClaudePermissionsIntoExistingSettings(t *testing.T) {
 	if strings.Count(settings, "Bash(devrites-engine check readiness *)") != 1 {
 		t.Fatalf("Claude permission was not merged exactly once:\n%s", settings)
 	}
+	for _, managed := range []string{"mcp__codegraph__*", "Bash(git diff *)", "Edit(.devrites/**)"} {
+		if !strings.Contains(settings, managed) {
+			t.Fatalf("Claude settings merge missed managed rule %q:\n%s", managed, settings)
+		}
+	}
+	if strings.Contains(settings, "retired-cmd") {
+		t.Fatalf("Claude settings merge kept a retired engine rule:\n%s", settings)
+	}
 	if strings.Contains(settings, "devrites-engine hook") {
 		t.Fatalf("installer retained a legacy DevRites hook:\n%s", settings)
 	}
@@ -243,7 +261,7 @@ func TestInstallMergesClaudePermissionsIntoExistingSettings(t *testing.T) {
 
 	runUninstall(t, target)
 	settings = testutil.ReadFile(t, filepath.Join(target, ".claude", "settings.json"))
-	for _, preserved := range []string{"keep my local notes", `"theme": "dark"`, "echo user-status", "echo user-stop", "Bash(user-tool *)", "Bash(rm *)", `"defaultMode": "plan"`} {
+	for _, preserved := range []string{"keep my local notes", `"theme": "dark"`, "echo user-status", "echo user-stop", "Bash(user-tool *)", "Bash(git checkout *)", "Bash(rm *)", `"defaultMode": "plan"`} {
 		if !strings.Contains(settings, preserved) {
 			t.Fatalf("Claude settings uninstall lost user content %q:\n%s", preserved, settings)
 		}
@@ -251,6 +269,11 @@ func TestInstallMergesClaudePermissionsIntoExistingSettings(t *testing.T) {
 	if strings.Contains(settings, "Bash(devrites-engine ") || strings.Contains(settings, "devrites-engine hook") {
 		t.Fatalf("Claude settings uninstall left DevRites configuration:\n%s", settings)
 	}
+	for _, managed := range []string{"mcp__codegraph__*", "Bash(git diff *)", "Edit(.devrites/**)"} {
+		if strings.Contains(settings, managed) {
+			t.Fatalf("Claude settings uninstall left managed non-engine rule %q:\n%s", managed, settings)
+		}
+	}
 }
 
 func TestInstallKeepsClaudeMergeOwnershipAcrossReinstall(t *testing.T) {
@@ -761,7 +784,7 @@ func TestLegacyCodexHooksMergeIsCleanupOnly(t *testing.T) {
 	if !ok || merge != legacy {
 		t.Fatalf("legacy marker lookup = %#v, %t", merge, ok)
 	}
-	if slices.Contains(hostpack.RequiredPayload(true, true, true), "codex/hooks.json") {
+	if slices.Contains(hostpack.RequiredPayload(true, true, true, true), "codex/hooks.json") {
 		t.Fatal("legacy Codex hooks entered the required payload")
 	}
 	r := runner{opts: DefaultOptions(ModeInstall), payloadFS: os.DirFS(testPayload(t))}
@@ -1235,7 +1258,7 @@ func writeTestPayload(t *testing.T, root string) {
 	testutil.WriteFile(t, filepath.Join(root, "claude", "settings.json"), `{
   "permissions": {
     "defaultMode": "plan",
-    "allow": ["Bash(devrites-engine check readiness *)"]
+    "allow": ["Bash(devrites-engine check readiness *)", "mcp__codegraph__*", "Bash(git diff *)", "Edit(.devrites/**)"]
   }
 }`+"\n")
 	testutil.WriteFile(t, filepath.Join(root, "codex", "skills", "rite", "SKILL.md"), "codex rite\n")
@@ -1254,6 +1277,9 @@ extends = ":workspace"
 	testutil.WriteFile(t, filepath.Join(root, "pi", "agents", "devrites-code-reviewer.md"), "pi agent\n")
 	testutil.WriteFile(t, filepath.Join(root, "pi", "prompts", "rite.md"), "pi prompt\n")
 	testutil.WriteFile(t, filepath.Join(root, "pi", "AGENTS.md"), "<!-- BEGIN DEVRITES PI -->\nDevRites\n<!-- END DEVRITES PI -->\n")
+	testutil.WriteFile(t, filepath.Join(root, "devin", "skills", "rite", "SKILL.md"), "devin rite\n")
+	testutil.WriteFile(t, filepath.Join(root, "devin", "agents", "devrites-code-reviewer.md"), "devin agent\n")
+	testutil.WriteFile(t, filepath.Join(root, "devin", "AGENTS.md"), "<!-- BEGIN DEVRITES DEVIN -->\nDevRites\n<!-- END DEVRITES DEVIN -->\n")
 }
 
 func testSource(t *testing.T, version string) string {