pi-harness-delegate 0.4.1 → 0.5.0

package/README.md

@@ -2,7 +2,7 @@
 
 [![npm version](https://img.shields.io/npm/v/pi-harness-delegate?logo=npm&color=CB3837)](https://www.npmjs.com/package/pi-harness-delegate) [![CI](https://github.com/yorch/pi-harness-delegate/actions/workflows/ci.yml/badge.svg)](https://github.com/yorch/pi-harness-delegate/actions/workflows/ci.yml) [![Release](https://github.com/yorch/pi-harness-delegate/actions/workflows/release.yml/badge.svg)](https://github.com/yorch/pi-harness-delegate/actions/workflows/release.yml) [![Node](https://img.shields.io/badge/node-26.x-brightgreen?logo=node.js)](https://nodejs.org) [![Bun](https://img.shields.io/badge/bun-1.3.14-black?logo=bun)](https://bun.sh) [![Biome](https://img.shields.io/badge/Biome-2.5.10-60a5fa)](https://biomejs.dev) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 
-Delegate work to **any harness** ([Claude Code](https://github.com/anthropics/claude-code), [Muse](https://github.com/openai/codex), [OpenCode](https://opencode.ai), [Amp](https://ampcode.com)) from the [pi coding agent](https://github.com/badlogic/pi-mono): code reviews, detailed plans, implementation, security audits, docs — or your own custom templates.
+Delegate work to **any harness** ([Claude Code](https://github.com/anthropics/claude-code), [Muse](https://github.com/openai/codex), [OpenCode](https://opencode.ai), [Amp](https://ampcode.com), [Devin](https://devin.ai)) from the [pi coding agent](https://github.com/badlogic/pi-mono): code reviews, detailed plans, implementation, security audits, docs — or your own custom templates.
 
 Each harness runs headless in your repo with a normalized permission (`readonly` / `edit` / `danger`). Results stream back live, and token/cost usage feeds into pi's footer stats. Templates are portable — prompt bodies live in `templates/shared/`, harness-specific frontmatter selects the native permission.
 
@@ -16,7 +16,9 @@ pi install npm:pi-harness-delegate
 pi install git:github.com/yorch/pi-harness-delegate
 ```
 
-Requires at least one harness binary on PATH (`claude --version`, `codex --version`, `opencode --version`, `amp --version`). Restart pi (or `/reload`) to activate.
+Requires at least one harness binary on PATH (`claude --version`, `codex --version`, `opencode --version`, `amp --version`, `devin --version`). Restart pi (or `/reload`) to activate.
+
+**Devin setup note:** `devin` refuses to run interactively (`devin`, `devin -p`) in a directory you haven't trusted yet — but this extension runs Devin over `devin acp` (see below), and live testing found that transport is **not** gated by workspace trust in the tested version (`3000.6.7`): a fresh, never-touched directory worked over ACP with no refusal and no prompt. This extension never sets Devin's `skip_workspace_trust` config key on your behalf either way — that stays a decision you make interactively, if you ever need it for `devin` itself.
 
 ## Usage
 
@@ -32,6 +34,7 @@ Manual delegation:
 /claude --mode=security-audit --scope=auth/ …          # alias → delegate --harness=claude
 /opencode plan the cache migration
 /amp implement the caching layer
+/devin review the new auth flow
 ```
 
 Only the prompt is required. A **harness as first word** and/or **mode as next word** selects them; every `--flag` is optional (harness defaults to `delegate.defaultHarness`, mode to `delegate.defaultMode`, scope to whole repo).
@@ -53,6 +56,8 @@ The `delegate` tool takes: `harness`, `task`, `mode`, `scope` (`diff` = git diff
 delegate({ harness: "all", mode: "review", scope: "diff" })   # tool call form
 ```
 
+- `all` resolves against *detected* harnesses, so Devin joins a fan-out automatically once `devin` is installed — a 5-harness fan-out costs more (and runs one more concurrent process) than the 4-harness one did, budget accordingly.
+
 - `all` resolves to whatever's actually installed (`detectAll()`) — an uninstalled harness is skipped and named in the report, it doesn't fail the run. An explicit list is validated the same way; an unknown name is also reported rather than aborting the rest.
 - Each harness's run goes through the same `delegate()` engine as a single-harness call and writes its own transcript to its own `~/.pi/agent/delegate/outputs/<harness>/`. Runs are launched together and execute in parallel, bounded by `maxConcurrent` (default `4`, one slot per supported harness) — a run beyond the cap queues for a free slot instead of failing, and the cap is enforced across pi processes, not just this one. **This means fan-out spend is genuinely simultaneous**: with the default cap, a 4-harness fan-out can bill all four at once instead of one after another — budget accordingly (`maxBudgetUsd` still applies per run).
 - The synthesized report is always ordered by the resolved harness list (e.g. `claude, codex, opencode`), regardless of which harness actually finishes first — it groups each harness's metrics + output and a total spend line (unknown-cost runs called out separately, same as `/delegate status`), assembled mechanically, not by asking a model to summarize.
@@ -78,6 +83,7 @@ delegate({ harness: "all", mode: "review", scope: "diff" })   # tool call form
 | `codex` | `codex` | `readonly→read-only`, `edit→workspace-write`, `danger→danger-full-access` | `codex exec --json`. Schema-verified against codex-cli 0.149.1; cost is always unmeasured (`null`) on ChatGPT-plan auth. |
 | `opencode` | `opencode` | `readonly→read-only`, `edit→allow-edit`, `danger→danger` | `opencode run --format json`. Schema-verified against opencode 1.18.16. |
 | `amp` | `amp` (`omp` alias) | `readonly→read-only`, `edit→workspace`, `danger→danger` | `<binary> -p --mode json`, resolves whichever of `amp`/`omp` is actually on `PATH`. Schema-verified against omp 17.2.9 (Sourcegraph's real Amp CLI is unverified). |
+| `devin` | `devin` | `readonly→plan`, `edit→accept-edits`, `danger→bypass` | Runs `devin acp` — [Agent Client Protocol](https://agentclientprotocol.com) over stdio, not stdout JSONL (see `acp-runner.ts`). Real tool-call ids, a genuine context-window %, and a working `sessionId`/resume via `session/load`. Reports no `$` cost (stays `null`) and no turn count. `model` is wired via `devin acp --model <MODEL>` (fuzzy names, e.g. `opus`); the reported `model` is read back from Devin's own `_cognition.ai/agent_stopped` event rather than echoed from the request, so it reflects what actually ran. Schema-verified against `devin 3000.6.7 (260a97c8)`. |
 
 Detect availability: `delegate` checks `harness --version` at startup; missing harnesses hint install instructions.
 

package/extensions/acp-runner.ts

@@ -0,0 +1,310 @@
+/**
+ * Sibling to runner.ts for harnesses whose `transport` is `'acp'` (Agent Client Protocol,
+ * https://agentclientprotocol.com — JSON-RPC 2.0, newline-delimited, over stdio). Unlike the
+ * stdout harnesses' one-way JSONL stream, ACP is bidirectional and stateful: the runner must
+ * drive a handshake (`initialize` -> `session/new` -> `session/set_mode` -> `session/prompt`)
+ * and hold stdin open for the session's lifetime — the agent exits on stdin EOF. It must also
+ * answer requests the agent sends back to us (permission prompts, fs reads) so the session
+ * doesn't hang, since we run non-interactively with a permission mode already negotiated.
+ *
+ * Exposes the exact `RunHarnessOptions`/`HarnessResult` shape as runner.ts, so `delegate()`
+ * can pick either runner from `harness.transport` and everything downstream (transcripts,
+ * `ToolCallIndex`, progress overlays, fan-out, spend rollup) is unchanged.
+ *
+ * Deliberately general: an agent's mode ids and result shape live in its `Harness` (`buildArgs`,
+ * `permissionMap`, `parseLine`, `extractResult`) — this file only knows the ACP wire protocol.
+ */
+import { spawn } from 'node:child_process';
+import { createInterface } from 'node:readline';
+import { DEFAULT_TIMEOUT_MS, type ParseState, type StreamedResult } from './harnesses/types.ts';
+import type { HarnessResult, RunHarnessOptions } from './runner.ts';
+
+/** Bound on the initial handshake (initialize / session/new / session/set_mode) so a hung agent
+ *  doesn't wedge the whole `timeoutMs` budget before `session/prompt` — the actual work — even starts. */
+const HANDSHAKE_TIMEOUT_MS = 30_000;
+
+const PROTOCOL_VERSION = 1;
+
+function isRecord(v: unknown): v is Record<string, unknown> {
+  return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+
+interface PendingRequest {
+  resolve: (result: unknown) => void;
+  reject: (err: Error) => void;
+  timer?: ReturnType<typeof setTimeout>;
+}
+
+export function runAcpHarness(opts: RunHarnessOptions): Promise<HarnessResult> {
+  return new Promise((resolve, reject) => {
+    const args = opts.harness.buildArgs({
+      prompt: opts.prompt,
+      cwd: opts.cwd,
+      permission: opts.permission,
+      nativePermission: opts.nativePermission,
+      model: opts.model,
+      maxBudgetUsd: opts.maxBudgetUsd,
+      addDirs: opts.addDirs,
+      resumeSessionId: opts.resumeSessionId,
+    });
+
+    const proc = spawn(opts.harness.binary, args, { cwd: opts.cwd, stdio: ['pipe', 'pipe', 'pipe'] });
+
+    const state: ParseState = { streamedText: '', activities: [], result: null, _harness: {} };
+    let stderr = '';
+    let settled = false;
+    let firstTokenAt: number | null = null;
+    // Resumed sessions replay every prior turn as session/update notifications before the new
+    // prompt's — set once session/prompt is actually sent, so replayed text/activities (and a
+    // replay-skewed TTFT) never reach the caller. See the handshake IIFE below.
+    let promptSent = false;
+    const startAt = Date.now();
+    const MAX_STREAMED = 5 * 1024 * 1024; // 5MB cap to prevent OOM on compromised harness
+    const MAX_ACTIVITIES = 5000;
+
+    let nextId = 1;
+    const pending = new Map<number, PendingRequest>();
+
+    const finish = (r: StreamedResult) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      rejectAllPending(new Error('session ended'));
+      const ttft = firstTokenAt !== null ? firstTokenAt - startAt : r.ttftMs;
+      resolve({ ...r, ttftMs: ttft, streamedText: state.streamedText, harness: opts.harness.name });
+    };
+    const fail = (err: Error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      rejectAllPending(err);
+      reject(err);
+    };
+    function rejectAllPending(err: Error): void {
+      for (const p of pending.values()) {
+        clearTimeout(p.timer);
+        p.reject(err);
+      }
+      pending.clear();
+    }
+
+    const writeLine = (msg: Record<string, unknown>): void => {
+      try {
+        proc.stdin.write(`${JSON.stringify(msg)}\n`);
+      } catch {
+        // stdin already closed (process exiting) — the pending request(s) time out/reject normally.
+      }
+    };
+
+    /** Send a JSON-RPC request and await its response. `timeoutMs` bounds only this request —
+     *  distinct from the overall run timeout — so a hung handshake step fails fast and clearly.
+     *  Omitted for `session/prompt`: that's the actual work, already bounded by the overall
+     *  `timer` below, which kills the process and rejects every pending request on fire. */
+    const sendRequest = (method: string, params: unknown, timeoutMs?: number): Promise<unknown> => {
+      const id = nextId++;
+      return new Promise((res, rej) => {
+        const entry: PendingRequest = { resolve: res, reject: rej };
+        if (timeoutMs !== undefined) {
+          entry.timer = setTimeout(() => {
+            pending.delete(id);
+            rej(new Error(`${method} timed out after ${timeoutMs}ms`));
+          }, timeoutMs);
+        }
+        pending.set(id, entry);
+        writeLine({ jsonrpc: '2.0', id, method, params });
+      });
+    };
+
+    /** Respond to a request the agent sent to us. Every request needs a reply or the agent's
+     *  session hangs waiting for it. */
+    const respond = (id: unknown, result: unknown): void => writeLine({ jsonrpc: '2.0', id, result });
+    const respondError = (id: unknown, message: string): void =>
+      writeLine({ jsonrpc: '2.0', id, error: { code: -32601, message } });
+
+    /** Handle a request FROM the agent (has both `method` and `id`). We run non-interactively
+     *  with a permission mode already negotiated, so the safe default is to decline anything
+     *  not already covered by that mode rather than auto-approve — never observed in the captured
+     *  fixture this harness was built from, but handled defensively since the spec allows it. */
+    const handleServerRequest = (msg: Record<string, unknown>): void => {
+      const { id, method, params } = msg;
+      if (method === 'session/request_permission' && isRecord(params) && Array.isArray(params.options)) {
+        const options = params.options as Array<{ optionId?: unknown; kind?: unknown }>;
+        const reject =
+          options.find(o => o.kind === 'reject_once') ??
+          options.find(o => o.kind === 'reject_always') ??
+          options.find(o => typeof o.kind === 'string' && o.kind.startsWith('reject'));
+        if (reject && typeof reject.optionId === 'string') {
+          respond(id, { outcome: { outcome: 'selected', optionId: reject.optionId } });
+        } else {
+          respond(id, { outcome: { outcome: 'cancelled' } });
+        }
+        return;
+      }
+      // fs/read_text_file, fs/write_text_file, terminal/* etc. — we declare no client capabilities
+      // for these in `initialize`, so a well-behaved agent shouldn't ask; decline defensively if one does.
+      respondError(id, `${String(method)} not supported by this client`);
+    };
+
+    const rl = createInterface({ input: proc.stdout });
+    rl.on('line', line => {
+      let msg: unknown;
+      try {
+        msg = JSON.parse(line);
+      } catch {
+        return;
+      }
+      if (!isRecord(msg)) return;
+
+      if (typeof msg.method === 'string' && msg.id !== undefined) {
+        handleServerRequest(msg);
+        return;
+      }
+      if (msg.id !== undefined && 'result' in msg) {
+        const entry = pending.get(msg.id as number);
+        if (entry) {
+          pending.delete(msg.id as number);
+          clearTimeout(entry.timer);
+          entry.resolve(msg.result);
+        }
+        // still fall through: `harness.parseLine` may also want to extract activity/result data.
+      } else if (msg.id !== undefined && 'error' in msg) {
+        const entry = pending.get(msg.id as number);
+        if (entry) {
+          pending.delete(msg.id as number);
+          clearTimeout(entry.timer);
+          const err = isRecord(msg.error) ? msg.error : {};
+          entry.reject(new Error(typeof err.message === 'string' ? err.message : `${msg.id} failed`));
+        }
+        return;
+      }
+
+      const outcome = opts.harness.parseLine(line, state);
+      // Discard streamed text/activities from anything that arrives before the new session/prompt
+      // is sent — on a resume that's the replayed prior conversation, not the new turn's own output.
+      if (promptSent && outcome.streamedText) {
+        if (firstTokenAt === null) firstTokenAt = Date.now();
+        if (state.streamedText.length < MAX_STREAMED) {
+          const remaining = MAX_STREAMED - state.streamedText.length;
+          const chunk =
+            outcome.streamedText.length > remaining
+              ? `${outcome.streamedText.slice(0, remaining)} [truncated ${outcome.streamedText.length - remaining} chars]`
+              : outcome.streamedText;
+          state.streamedText += chunk;
+          opts.onStream?.(chunk);
+        }
+      }
+      if (promptSent && outcome.activities) {
+        for (const a of outcome.activities) {
+          if (state.activities.length < MAX_ACTIVITIES) {
+            state.activities.push(a);
+            opts.onActivity?.(a);
+          }
+        }
+      }
+      if (outcome.result) {
+        if (!outcome.result.result) outcome.result.result = state.streamedText;
+        state.result = outcome.result;
+      }
+    });
+
+    proc.stderr.on('data', (d: Buffer) => (stderr += d.toString()));
+    proc.on('close', code => {
+      rejectAllPending(new Error(`${opts.harness.binary} exited`));
+      if (code !== 0 && !state.result) {
+        fail(new Error(stderr.trim() || `${opts.harness.binary} exited with code ${code}`));
+        return;
+      }
+      const final = state.result ?? opts.harness.extractResult(state);
+      if (final) {
+        if (!final.result) final.result = state.streamedText;
+        finish(final);
+      } else if (code !== 0) {
+        fail(new Error(stderr.trim() || `${opts.harness.binary} exited with code ${code}`));
+      } else {
+        fail(new Error(`${opts.harness.binary} finished without emitting a result`));
+      }
+    });
+    proc.on('error', err => {
+      fail(new Error(`failed to start ${opts.harness.binary}: ${err.message}`));
+    });
+
+    const timer = setTimeout(() => {
+      proc.kill('SIGKILL');
+      fail(new Error(`${opts.harness.binary} timed out after ${opts.timeoutMs ?? DEFAULT_TIMEOUT_MS}ms`));
+    }, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    timer.unref?.();
+
+    opts.signal?.addEventListener(
+      'abort',
+      () => {
+        proc.kill('SIGKILL');
+        fail(new Error('cancelled'));
+      },
+      { once: true },
+    );
+
+    // Drive the handshake. `session/prompt` has no separate timeout — it's the actual work,
+    // bounded by the overall `timer` above like everything else.
+    (async () => {
+      const modeId = opts.nativePermission ?? opts.harness.permissionMap?.[opts.permission]?.[0] ?? opts.permission;
+      await sendRequest(
+        'initialize',
+        {
+          protocolVersion: PROTOCOL_VERSION,
+          clientCapabilities: {}, // no fs/terminal proxying — decline those requests if asked (see handleServerRequest)
+        },
+        HANDSHAKE_TIMEOUT_MS,
+      );
+      if (settled) return;
+      const sessionParams = {
+        cwd: opts.cwd,
+        mcpServers: [],
+        ...(opts.addDirs && opts.addDirs.length > 0 ? { additionalDirectories: opts.addDirs } : {}),
+      };
+      // `session/load` resumes a prior session by id (its response carries no sessionId of its
+      // own — the client already has it) and replays prior turns as session/update notifications
+      // before the new prompt's; `session/new` mints a fresh one. Verified live: loadSession is
+      // advertised in agentCapabilities and a real session/load + follow-up prompt round-trips
+      // cleanly, replaying history and continuing the same token-usage accounting.
+      let sessionId: string | null;
+      if (opts.resumeSessionId) {
+        await sendRequest('session/load', { sessionId: opts.resumeSessionId, ...sessionParams }, HANDSHAKE_TIMEOUT_MS);
+        sessionId = opts.resumeSessionId;
+      } else {
+        const newSession = await sendRequest('session/new', sessionParams, HANDSHAKE_TIMEOUT_MS);
+        sessionId = isRecord(newSession) && typeof newSession.sessionId === 'string' ? newSession.sessionId : null;
+      }
+      if (settled) return;
+      if (!sessionId) throw new Error('session/new did not return a sessionId');
+      // session/load's response carries no sessionId of its own (unlike session/new's) — stash it
+      // so the harness's parseLine can still report the real session id on the final result.
+      if (opts.resumeSessionId) {
+        state._harness ??= {};
+        state._harness.sessionId = sessionId;
+      }
+      await sendRequest('session/set_mode', { sessionId, modeId }, HANDSHAKE_TIMEOUT_MS);
+      if (settled) return;
+      promptSent = true;
+      await sendRequest('session/prompt', { sessionId, prompt: [{ type: 'text', text: opts.prompt }] });
+      if (settled) return;
+      // The agent doesn't exit on its own once the turn is done — an ACP session can outlive a
+      // single prompt (resume, follow-up turns). `delegate()` is one-shot per process, so finish
+      // as soon as the prompt response resolves (parseLine already turned it into state.result,
+      // synchronously, before this await's continuation runs) and tear the process down ourselves.
+      const final = state.result ?? opts.harness.extractResult(state);
+      if (final) {
+        if (!final.result) final.result = state.streamedText;
+        finish(final);
+      } else {
+        fail(new Error(`${opts.harness.binary} session/prompt completed without emitting a result`));
+      }
+      proc.kill('SIGKILL');
+    })().catch(err => {
+      // Every other exit path (timeout, abort, success) kills the child — a rejected handshake
+      // step (bad modeId, a JSON-RPC error, a HANDSHAKE_TIMEOUT_MS expiry) must too, or the
+      // process leaks: ACP agents only exit on stdin EOF, which nothing else here sends.
+      proc.kill('SIGKILL');
+      fail(err instanceof Error ? err : new Error(String(err)));
+    });
+  });
+}

package/extensions/harnesses/devin.ts

@@ -0,0 +1,206 @@
+/**
+ * Devin — runs over the Agent Client Protocol (`devin acp`), not stdout JSONL. `transport: 'acp'`
+ * routes it through extensions/acp-runner.ts instead of runner.ts; `buildArgs` here only needs to
+ * spawn the ACP server (`devin acp`) — the prompt, permission mode, and session lifecycle are all
+ * negotiated over the wire by acp-runner.ts, not passed as CLI flags.
+ *
+ * `parseLine`/`extractResult` translate raw ACP JSON-RPC lines (one per line, same as any other
+ * harness's JSONL) into `ParseOutcome`/`StreamedResult` — this is what makes the JSON-RPC plumbing
+ * testable via the same fixture-replay pattern as the stdout harnesses (tests/fixtures.test.ts),
+ * without spawning a process: `tests/fixtures/devin-acp.jsonl` is a real captured session.
+ *
+ * Schema verified against `devin 3000.6.7 (260a97c8)` — see docs/devin-acp-harness-design.md.
+ *
+ * Workspace trust: the design note this was built from flagged `devin`'s interactive workspace-trust
+ * gate as a hazard needing a `detect()` hint. Live verification found that gate applies to `devin -p`
+ * / interactive `devin`, but NOT to `devin acp` — confirmed by running the raw `initialize`/`session/new`
+ * handshake against a directory never seen by devin before (no `--config` bypass), which succeeded with
+ * no refusal, while `devin -p` in the same directory refused. So this harness's actual code path was
+ * never gated in the first place; no hint or bypass is needed. If a future devin version starts
+ * enforcing trust over ACP too, the generic non-zero-exit path in acp-runner.ts already surfaces
+ * whatever refusal message devin prints, same as any other process failure.
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import type {
+  ActivityEvent,
+  BuildArgsOpts,
+  Harness,
+  NormalizedPermission,
+  ParseOutcome,
+  ParseState,
+  StreamedResult,
+} from './types.ts';
+
+const execFileAsync = promisify(execFile);
+
+function isRecord(v: unknown): v is Record<string, unknown> {
+  return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+
+/** Exact structural match to Claude's tiers (session/new's captured `availableModes`: plan, accept-edits,
+ *  smart, ask, bypass). `smart`/`ask` stay reachable via the existing `nativePermission` escape hatch. */
+const PERMISSION_MAP: Record<NormalizedPermission, string> = {
+  readonly: 'plan',
+  edit: 'accept-edits',
+  danger: 'bypass',
+};
+
+/** Translate one `session/update` notification's `params.update` payload into ParseOutcome deltas. */
+function translateUpdate(update: Record<string, unknown>, state: ParseState): ParseOutcome {
+  const activities: ActivityEvent[] = [];
+  let streamedText: string | undefined;
+  const content = isRecord(update.content) ? update.content : undefined;
+  const text = content?.type === 'text' && typeof content.text === 'string' ? content.text : undefined;
+
+  switch (update.sessionUpdate) {
+    case 'agent_message_chunk':
+      if (text !== undefined) streamedText = text;
+      break;
+    case 'agent_thought_chunk':
+      if (text !== undefined) activities.push({ kind: 'thinking', chars: text.length });
+      break;
+    case 'tool_call': {
+      if (typeof update.toolCallId !== 'string') break;
+      const meta = isRecord(update._meta) ? update._meta : {};
+      const inferenceName = meta['cognition.ai/inferenceToolName'];
+      const name =
+        typeof inferenceName === 'string' ? inferenceName : typeof update.kind === 'string' ? update.kind : 'tool';
+      activities.push({
+        kind: 'tool_input',
+        name,
+        input: isRecord(update.rawInput) ? update.rawInput : {},
+        id: update.toolCallId,
+      });
+      break;
+    }
+    case 'tool_call_update': {
+      // Only a terminal status produces a tool_result. A call fires multiple `in_progress`
+      // updates for the same toolCallId before its `completed`/`failed` (real fixture: 2-3 per
+      // id) — ToolCallIndex.resolve() consumes the pending entry on first match, so an earlier
+      // in_progress "result" would eat the id and strand the real completion unattributed.
+      if (typeof update.toolCallId !== 'string') break;
+      if (update.status === 'completed' || update.status === 'failed') {
+        activities.push({ kind: 'tool_result', isError: update.status === 'failed', id: update.toolCallId });
+      }
+      break;
+    }
+    case 'usage_update':
+      state._harness ??= {};
+      if (typeof update.size === 'number') state._harness.contextWindow = update.size;
+      break;
+    default:
+      break;
+  }
+  return { streamedText, activities };
+}
+
+export function parseDevinLine(line: string, state: ParseState): ParseOutcome {
+  let o: unknown;
+  try {
+    o = JSON.parse(line);
+  } catch {
+    return {};
+  }
+  if (!isRecord(o)) return {};
+
+  if (o.method === 'session/update' && isRecord(o.params) && isRecord(o.params.update)) {
+    return translateUpdate(o.params.update, state);
+  }
+
+  if (o.method === '_cognition.ai/agent_stopped' && isRecord(o.params) && isRecord(o.params.stats)) {
+    // The real model Devin ran, independent of whatever --model was requested — the honest
+    // value to report, since `--model` accepts fuzzy names and enterprise config can override it.
+    const label = o.params.stats.modelLabel;
+    if (typeof label === 'string') {
+      state._harness ??= {};
+      state._harness.model = label;
+    }
+    return {};
+  }
+
+  if (isRecord(o.result)) {
+    const r = o.result;
+    if (typeof r.stopReason === 'string') {
+      // session/prompt response — the turn is over, build the final result.
+      const u = isRecord(r.usage) ? r.usage : null;
+      const harnessState = isRecord(state._harness) ? state._harness : {};
+      // Devin's inputTokens already includes cachedReadTokens as a subset (fixture: on every
+      // usage_update/prompt result, used === inputTokens + outputTokens exactly, and
+      // cachedReadTokens < inputTokens). StreamedUsage follows Claude's convention where
+      // inputTokens EXCLUDES cache reads (index.ts sums inputTokens + cacheReadInputTokens into
+      // promptTokens) — so subtract the cache-read subset back out here, or promptTokens/context%
+      // double-counts it. Math.max guards against a negative if that invariant ever breaks.
+      const cacheReadInputTokens = typeof u?.cachedReadTokens === 'number' ? u.cachedReadTokens : 0;
+      const rawInputTokens = typeof u?.inputTokens === 'number' ? u.inputTokens : 0;
+      const result: StreamedResult = {
+        result: state.streamedText,
+        // Devin's ACP prompt response carries no error flag of its own — a genuine failure
+        // (JSON-RPC `error`, non-zero exit, workspace-trust refusal) surfaces via acp-runner.ts's
+        // process-level fail() path instead, same as every other harness's non-zero-exit case.
+        isError: false,
+        numTurns: null, // not reported for a single prompt turn
+        totalCostUsd: null, // Devin reports no $ cost over ACP — honest-metrics convention (#11)
+        sessionId: typeof harnessState.sessionId === 'string' ? harnessState.sessionId : null,
+        stopReason: r.stopReason,
+        permissionDenials: [],
+        durationMs: null,
+        durationApiMs: null,
+        ttftMs: null,
+        model: typeof harnessState.model === 'string' ? harnessState.model : null,
+        contextWindow: typeof harnessState.contextWindow === 'number' ? harnessState.contextWindow : null,
+        maxOutputTokens: null,
+        usage: u
+          ? {
+              inputTokens: Math.max(0, rawInputTokens - cacheReadInputTokens),
+              outputTokens: typeof u.outputTokens === 'number' ? u.outputTokens : 0,
+              cacheCreationInputTokens: 0, // not reported over ACP
+              cacheReadInputTokens,
+            }
+          : null,
+      };
+      return { result };
+    }
+    if (typeof r.sessionId === 'string') {
+      // session/new response — stash the id; the prompt response above has no sessionId of its own.
+      state._harness ??= {};
+      state._harness.sessionId = r.sessionId;
+    }
+  }
+  return {};
+}
+
+export const devinHarness: Harness = {
+  name: 'devin',
+  displayName: 'Devin',
+  binary: 'devin',
+  transport: 'acp',
+  async detect() {
+    try {
+      const { stdout } = await execFileAsync('devin', ['--version'], { timeout: 5000 });
+      return { ok: true, version: stdout.trim() };
+    } catch {
+      return { ok: false, hint: 'Install the Devin CLI: https://docs.devin.ai/' };
+    }
+  },
+  buildArgs(opts: BuildArgsOpts): string[] {
+    // The prompt, permission mode, and session lifecycle are all negotiated over the ACP wire
+    // (see acp-runner.ts) — this just launches the ACP server. `--model` is the one real CLI flag
+    // `devin acp` accepts (verified: `devin acp --help`); it sets the default model for every new
+    // ACP session on this server, and accepts fuzzy names (family slug, alias, or partial name).
+    const args = ['acp'];
+    if (opts.model) args.push('--model', opts.model);
+    return args;
+  },
+  parseLine(line: string, state: ParseState): ParseOutcome {
+    return parseDevinLine(line, state);
+  },
+  extractResult(state: ParseState): StreamedResult | null {
+    return state.result;
+  },
+  permissionMap: {
+    readonly: [PERMISSION_MAP.readonly],
+    edit: [PERMISSION_MAP.edit],
+    danger: [PERMISSION_MAP.danger],
+  },
+};

package/extensions/harnesses/registry.ts

@@ -1,6 +1,7 @@
 import { ampHarness } from './amp.ts';
 import { claudeHarness } from './claude.ts';
 import { codexHarness } from './codex.ts';
+import { devinHarness } from './devin.ts';
 import { opencodeHarness } from './opencode.ts';
 import type { Harness } from './types.ts';
 
@@ -9,6 +10,7 @@ export const HARNESSES: Record<string, Harness> = {
   codex: codexHarness,
   opencode: opencodeHarness,
   amp: ampHarness,
+  devin: devinHarness,
 };
 
 export const ALIASES: Record<string, string> = {
@@ -49,3 +51,30 @@ export function isKnownHarness(name: string): boolean {
 }
 
 export const normalizeHarnessName = resolveHarnessName;
+
+/**
+ * Legacy danger spellings, kept for templates written before harnesses were partitioned.
+ */
+const LEGACY_DANGER_TOKENS = new Set(['bypassPermissions', 'danger-full-access', 'danger']);
+
+/**
+ * Does this native permission string mean "unrestricted" for this harness?
+ *
+ * A template can declare any native mode via the escape hatch (`permission: <native>`), and
+ * `normalizePermission` files anything unrecognised under `nativePermission` with a normalized
+ * tier of `edit`. Without this check, a template declaring `yolo` (amp) or `bypass` (devin) would
+ * skip the `allowDangerous` gate entirely and run the harness unsandboxed while `delegate()`
+ * recorded the run as `edit` — breaking the invariant that danger is only ever reachable through
+ * an explicit per-call `allowDangerous: true`.
+ *
+ * Matches the harness's own `permissionMap.danger`, joined, so a multi-token danger mode is
+ * compared as a whole: opencode's danger is `['build', '--auto']`, and bare `build` is its *edit*
+ * token — treating each token separately would wrongly gate legitimate `edit` templates.
+ */
+export function isNativeDangerPermission(harness: Harness | undefined, nativePermission: string | undefined): boolean {
+  if (!nativePermission) return false;
+  const native = nativePermission.trim();
+  if (LEGACY_DANGER_TOKENS.has(native)) return true;
+  const danger = harness?.permissionMap?.danger;
+  return Array.isArray(danger) && danger.length > 0 && native === danger.join(' ');
+}

package/extensions/harnesses/types.ts

@@ -74,6 +74,11 @@ export interface DetectResult {
   hint?: string;
 }
 
+/** Which runner drives a harness. Defaults to 'stdout' (extensions/runner.ts) when omitted.
+ *  'acp' (extensions/acp-runner.ts) is for Agent Client Protocol agents — a bidirectional
+ *  JSON-RPC session over stdio rather than a one-way JSONL stream. See AGENTS.md. */
+export type Transport = 'stdout' | 'acp';
+
 export interface Harness {
   name: string;
   displayName: string;
@@ -90,6 +95,10 @@ export interface Harness {
   /** Normalized -> native arg fragments. */
   permissionMap?: Record<NormalizedPermission, string[]>;
   permissionHint?: (permission: NormalizedPermission) => string[];
+  /** Runner selection. Omitted/'stdout' -> runner.ts (the four existing harnesses); 'acp' -> acp-runner.ts.
+   *  For 'acp', `permissionMap`'s first element per tier is the ACP session mode id (session/set_mode) —
+   *  the same field the stdout harnesses use for CLI arg fragments, reused rather than duplicated. */
+  transport?: Transport;
 }
 
 export const DEFAULT_TIMEOUT_MS = 600_000;

package/extensions/index.ts

@@ -3,7 +3,7 @@
  *
  * Registers:
  *   - `delegate` tool (primary) + `claude_delegate` alias
- *   - `/delegate` command (primary) + `/claude`, `/codex`, `/opencode`, `/amp`, `/omp` aliases
+ *   - `/delegate` command (primary) + `/claude`, `/codex`, `/opencode`, `/amp`, `/omp`, `/devin` aliases
  *
  * Templates ship in ../templates/shared + ../templates/<harness>; users add custom ones in
  *   ~/.pi/agent/delegate/templates/<harness>/  (global)
@@ -29,6 +29,7 @@ import {
   truncateToWidth,
 } from '@earendil-works/pi-tui';
 import { Type } from 'typebox';
+import { runAcpHarness } from './acp-runner.ts';
 import {
   aggregateSpend,
   buildFanoutReport,
@@ -64,16 +65,16 @@ import {
   getHarness,
   HARNESS_NAMES,
   isKnownHarness,
+  isNativeDangerPermission,
   resolveHarnessName,
 } from './harnesses/registry.ts';
 import type { ActivityEvent, NormalizedPermission } from './harnesses/types.ts';
-
 import { delegationHint, stripMarker } from './hint.ts';
 import { NotifyBatcher } from './notify.ts';
 import { type FeedEntry, progressWindow } from './progress.ts';
 import { formatFanoutChip, multiProgressWindow, type RunRow } from './progress-multi.ts';
 import { runHarness } from './runner.ts';
-import { type DelegateTemplate, loadTemplates } from './templates.ts';
+import { type DelegateTemplate, loadTemplates, resolveNativePermission } from './templates.ts';
 import { mapClaudeUsage } from './usage.ts';
 
 /** Render a possibly-unknown cost — `null` means the harness didn't report one, not a measured $0. */
@@ -551,7 +552,7 @@ async function delegate(
   // permission: normalized, danger requires explicit per-call allowDangerous:true
   let permission: NormalizedPermission = template.permission;
   const nativePerm = template.nativePermission;
-  const isNativeDanger = !!nativePerm && ['bypassPermissions', 'danger-full-access', 'danger'].includes(nativePerm);
+  const isNativeDanger = isNativeDangerPermission(harness, nativePerm);
   if (template.permission === 'danger' || isNativeDanger) {
     if (opts.allowDangerous !== true) {
       throw new Error(
@@ -564,6 +565,9 @@ async function delegate(
     permission = 'danger';
   }
   const permissionForDisplay = nativePerm ?? permission;
+  // Dropped when an explicit escalation moved us off the template's own tier — see
+  // resolveNativePermission(). Applies to both transports.
+  const nativePermissionForRun = resolveNativePermission(template.permission, permission, nativePerm);
 
   const model = resolveModelForHarness(config, harnessName, opts.model, template.model);
   const prompt = buildPrompt(template, task, scopeText, ctx.cwd, harnessName);
@@ -572,7 +576,7 @@ async function delegate(
   let streamedFull = '';
   let result: import('./runner.ts').HarnessResult;
   try {
-    result = await runHarness({
+    const baseRunOpts = {
       harness,
       prompt,
       cwd: ctx.cwd,
@@ -586,15 +590,17 @@ async function delegate(
       signal: opts.signal,
       timeoutMs: config.harnesses[harnessName]?.timeoutMs ?? config.timeoutMs,
       resumeSessionId: opts.sessionId,
-      onStream: t => {
+      onStream: (t: string) => {
         streamedFull += t;
         opts.onStream?.(t);
       },
-      onActivity: ev => {
+      onActivity: (ev: ActivityEvent) => {
         activityEvents.push(ev);
         opts.onActivity?.(ev);
       },
-    });
+      nativePermission: nativePermissionForRun,
+    };
+    result = harness.transport === 'acp' ? await runAcpHarness(baseRunOpts) : await runHarness(baseRunOpts);
   } catch (err) {
     release();
     if (streamedFull.length > 0) {
@@ -960,11 +966,11 @@ export default function (pi: ExtensionAPI) {
     name: 'delegate',
     label: 'Delegate',
     description:
-      'Delegate a task to any harness (claude, codex, opencode, amp) running headless in the repo and return its streamed report (cost, token usage, context %, session id). harness selects the backend (default from config, fallback claude) — pass "all" or a comma list (e.g. "claude,codex") to fan out the same task to several harnesses and get back one comparison report. mode selects a template: review, plan, implement, security-audit, docs, general, or custom — some templates run a host-side check (e.g. "bun test") after the harness exits and report pass/fail as separate evidence; that is configured on the template, not a parameter here. scope restricts work: diff for current git diff, pr for PR diff, path list, or whole repo. sessionId continues a prior session.',
+      'Delegate a task to any harness (claude, codex, opencode, amp, devin) running headless in the repo and return its streamed report (cost, token usage, context %, session id). harness selects the backend (default from config, fallback claude) — pass "all" or a comma list (e.g. "claude,codex") to fan out the same task to several harnesses and get back one comparison report. mode selects a template: review, plan, implement, security-audit, docs, general, or custom — some templates run a host-side check (e.g. "bun test") after the harness exits and report pass/fail as separate evidence; that is configured on the template, not a parameter here. scope restricts work: diff for current git diff, pr for PR diff, path list, or whole repo. sessionId continues a prior session.',
     promptSnippet: 'Delegate a subtask to a harness and return its report',
     promptGuidelines: [
       'delegate runs a harness headless in the working directory and returns a streamed report with cost, token usage, and a session id for follow-ups.',
-      'Pass harness (claude|codex|opencode|amp) + focused task string + intent and constraints. Use scope: diff for current git diff, pr for PR diff, path list, or omit for whole repo.',
+      'Pass harness (claude|codex|opencode|amp|devin) + focused task string + intent and constraints. Use scope: diff for current git diff, pr for PR diff, path list, or omit for whole repo.',
       'mode selects the template and its permission level: review/plan/security-audit are readonly; implement/docs/general are edit. Custom template names also work. Some templates verify their own work (e.g. running tests) automatically after the harness finishes — that is not something you configure here.',
       'harness: "all" or a comma list (e.g. "codex,opencode") fans the same task out to each detected harness and returns one synthesized comparison report — costs multiply, so only use it when the user actually wants a multi-harness comparison.',
       'sessionId resumes a previous delegated session instead of starting fresh.',
@@ -974,7 +980,7 @@ export default function (pi: ExtensionAPI) {
       harness: Type.Optional(
         Type.String({
           description:
-            'Harness to use: claude, codex, opencode, amp (aliases: omp). "all" or a comma list (e.g. "claude,codex") fans out to each detected harness. Defaults to config defaultHarness.',
+            'Harness to use: claude, codex, opencode, amp (aliases: omp), devin. "all" or a comma list (e.g. "claude,codex") fans out to each detected harness. Defaults to config defaultHarness.',
         }),
       ),
       task: Type.String({ description: 'The task/intent to delegate. Be specific.' }),
@@ -1682,7 +1688,7 @@ export default function (pi: ExtensionAPI) {
         );
       else
         ctx.ui.notify?.(
-          'Usage: /delegate [--harness=claude|codex|opencode|amp|all] [--mode=…] [--model=…] [--scope=…] [--verify=…] <prompt>',
+          'Usage: /delegate [--harness=claude|codex|opencode|amp|devin|all] [--mode=…] [--model=…] [--scope=…] [--verify=…] <prompt>',
           'warning',
         );
       return;
@@ -1752,7 +1758,7 @@ export default function (pi: ExtensionAPI) {
 
   pi.registerCommand('delegate', {
     description:
-      'Delegate a task to any harness. Usage: /delegate [--harness=claude|codex|opencode|amp|all] [--mode=review|plan|implement|security-audit|docs|general] [--model=...] [--scope=diff|pr|paths] [--verify=<cmd>] [--resume=<id>] <prompt> — or use harness as first word: /delegate codex review <prompt>. harness=all or a comma list (e.g. claude,codex) fans out to every detected harness and returns one comparison report.',
+      'Delegate a task to any harness. Usage: /delegate [--harness=claude|codex|opencode|amp|devin|all] [--mode=review|plan|implement|security-audit|docs|general] [--model=...] [--scope=diff|pr|paths] [--verify=<cmd>] [--resume=<id>] <prompt> — or use harness as first word: /delegate codex review <prompt>. harness=all or a comma list (e.g. claude,codex) fans out to every detected harness and returns one comparison report.',
     handler: makeHandler(),
   });
   pi.registerCommand('claude', {
@@ -1775,6 +1781,10 @@ export default function (pi: ExtensionAPI) {
     description: 'Alias for /delegate --harness=amp (omp compat). Usage: /omp [--mode=...] <prompt>',
     handler: makeHandler('amp'),
   });
+  pi.registerCommand('devin', {
+    description: 'Alias for /delegate --harness=devin. Usage: /devin [--mode=...] <prompt>',
+    handler: makeHandler('devin'),
+  });
 
   pi.on('input', async (event, _ctx) => {
     if (event.source === 'extension') return { action: 'continue' };

package/extensions/templates.ts

@@ -43,11 +43,11 @@ export function normalizePermission(
     const lower = raw.trim().toLowerCase();
     if (lower === 'readonly' || lower === 'read-only' || lower === 'read_only')
       return { permission: 'readonly', permissionMode: 'plan' };
-    if (lower === 'edit' || lower === 'acceptEdits' || lower === 'accept-edits')
+    if (lower === 'edit' || lower === 'acceptedits' || lower === 'accept-edits')
       return { permission: 'edit', permissionMode: 'acceptEdits' };
     if (
       lower === 'danger' ||
-      lower === 'bypassPermissions' ||
+      lower === 'bypasspermissions' ||
       lower === 'danger-full-access' ||
       lower === 'danger_full_access'
     )
@@ -184,3 +184,21 @@ export function loadTemplates(cwd: string, harnessName?: string): Map<string, De
 export function loadAllTemplates(cwd: string): Map<string, DelegateTemplate> {
   return loadTemplates(cwd);
 }
+
+/**
+ * Which native permission string (if any) to hand the harness for this run.
+ *
+ * A template's native escape hatch (`permissionMode`/`sandbox`) applies only while the effective
+ * permission is still the template's own. Every harness's `buildArgs` prefers `nativePermission`
+ * over the normalized map, so passing it unconditionally would let a template's native mode
+ * silently override an explicit `allowDangerous` escalation — a per-call escalation would be
+ * quietly downgraded back to whatever the template declared.
+ */
+export function resolveNativePermission(
+  templatePermission: NormalizedPermission,
+  effectivePermission: NormalizedPermission,
+  nativePermission: string | undefined,
+): string | undefined {
+  if (!nativePermission) return undefined;
+  return effectivePermission === templatePermission ? nativePermission : undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-harness-delegate",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Delegate work to any harness (Claude Code, Muse, OpenCode, Amp) from the pi coding agent \u2014 code reviews, plans, implementation, security audits, docs, or your own custom templates.",
   "type": "module",
   "packageManager": "bun@1.3.14",

package/templates/devin/docs.md

@@ -0,0 +1,10 @@
+---
+name: docs
+description: Generate or update documentation. Writes files.
+permission: edit
+---
+You are a technical writer delegated by the pi coding agent.
+
+Write clear, accurate documentation matching the project's existing doc style
+(check for README/ADRs/docs conventions first). Cover usage, gotchas, and
+worked examples. Report which files you created or changed.

package/templates/devin/general.md

@@ -0,0 +1,8 @@
+---
+name: general
+description: General delegation — any task. Bounded to file edits unless allowDangerous is set.
+permission: edit
+---
+You are a capable engineer delegated by the pi coding agent to handle the
+following task. Work in the current repository. Follow its conventions, run
+available checks, and report what you did and why.

package/templates/devin/implement.md

@@ -0,0 +1,12 @@
+---
+name: implement
+description: Implement a task with file edits (auto-accepted). Runs checks.
+permission: edit
+---
+You are a senior engineer delegated by the pi coding agent to implement a
+task.
+
+Implement the task described below. Follow the repo's existing conventions.
+Run the relevant checks when present (tests, typecheck, lint) and fix what
+breaks. Keep changes minimal and focused on the task. Report what you changed
+and the verification you ran.

package/templates/devin/plan.md

@@ -0,0 +1,17 @@
+---
+name: plan
+description: Produce a detailed implementation plan from an intent. Read-only.
+permission: readonly
+---
+You are a staff engineer delegated by the pi coding agent to produce a
+detailed implementation plan.
+
+Understand the current codebase first (read the relevant files). Then produce:
+1. Goal and non-goals
+2. Proposed approach, with alternatives considered and why rejected
+3. Step-by-step implementation plan: ordered steps, each naming the files to
+   touch and what changes in them
+4. Risks, edge cases, and testing strategy
+
+Be concrete and reference actual files/functions in the repo. Do not edit
+files — this is a plan.

package/templates/devin/review.md

@@ -0,0 +1,18 @@
+---
+name: review
+description: Code review of a scope (git diff, files, or the whole repo). Read-only.
+permission: readonly
+defaultTask: Review the current git diff (staged + unstaged)
+defaultScope: diff
+---
+You are a senior code reviewer delegated by the pi coding agent.
+
+Review the provided scope for:
+- Correctness bugs and edge cases
+- Security issues (injection, auth, secrets, unsafe deserialization)
+- Performance problems
+- Code style and maintainability
+
+Be specific: cite `file:line` for every finding. Classify each finding as
+Critical / Major / Minor / Nit. End with a prioritized list of the top
+actions. Do not edit files — this is a review.

package/templates/devin/security-audit.md

@@ -0,0 +1,17 @@
+---
+name: security-audit
+description: Security audit of a scope. Read-only.
+permission: readonly
+defaultTask: Audit this repository for security vulnerabilities
+---
+You are a security auditor delegated by the pi coding agent.
+
+Audit the provided scope for:
+- Injection (SQL, command, path, template)
+- Authentication / authorization gaps
+- Secrets and credential handling
+- Insecure defaults, unsafe deserialization, XXE, SSRF
+- Dependency and supply-chain risks
+
+Cite `file:line` for every finding. Rank findings by severity and
+exploitability. Do not edit files — this is an audit.