hx-cli 0.2.1__tar.gz → 0.2.2__tar.gz

{hx_cli-0.2.1 → hx_cli-0.2.2}/CHANGELOG.md

@@ -28,6 +28,38 @@ the project follows [semantic versioning](https://semver.org/).
 
 ---
 
+## [0.2.2] - 2026-09-17
+
+### Added
+
+- Devin subscription as a third route: `hx auth login devin` (or `/login`)
+  signs in through the browser, and `devin/<model>` ids run against the plan -
+  every model the account includes, listed by `/model` and refreshed with
+  `/models refresh`. Reasoning depths Devin ships as separate models are folded
+  into one, so `/effort` picks the depth, and router models such as
+  `devin/adaptive` are assigned per turn. A session token in `DEVIN_API_KEY`
+  works where there is no browser. Devin Enterprise accounts sign in through
+  the same command by choosing "Log in with Devin for Enterprise".
+
+### Fixed
+
+- The `/login` dialog no longer sits on "Starting…" for the whole sign-in: it
+  now updates as the flow moves on, and keeps the instructions on screen
+  alongside the link, progress and paste field instead of overwriting them.
+
+- Resizing the terminal no longer crashes the session. A window manager sends
+  a burst of SIGWINCH for one drag of a corner, and a signal landing while the
+  previous frame was still writing re-entered stdout: `RuntimeError: reentrant
+  call inside <_io.BufferedWriter>`, and HX was gone. The redraw is handed to
+  the event loop now, and the burst collapses into one repaint.
+
+- `/resume` and `hx resume` bring the whole conversation back, not only its
+  text: the reasoning, tool calls, their output and the plan are drawn again.
+  A resumed session used to show a blank tinted bar for each tool result and
+  nothing at all for the calls themselves.
+
+---
+
 ## [0.2.1] - 2026-09-14
 
 ### Changed
@@ -408,7 +440,8 @@ First release, published to PyPI as [`hx-cli`](https://pypi.org/project/hx-cli/)
 - `/configure` and `hx auth` for the OpenRouter key, `hx upgrade` for
   self-update, and `install.sh` bootstrapping uv with a pinned Python.
 
-[Unreleased]: https://github.com/aletisunil/hx/compare/v0.2.1...HEAD
+[Unreleased]: https://github.com/aletisunil/hx/compare/v0.2.2...HEAD
+[0.2.2]: https://github.com/aletisunil/hx/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/aletisunil/hx/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/aletisunil/hx/compare/v0.1.9...v0.2.0
 [0.1.9]: https://github.com/aletisunil/hx/compare/v0.1.8...v0.1.9

{hx_cli-0.2.1 → hx_cli-0.2.2}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.5
 Name: hx-cli
-Version: 0.2.1
-Summary: HX - a terminal coding agent
+Version: 0.2.2
+Summary: HX - an agent harness for the terminal
 Project-URL: Homepage, https://github.com/aletisunil/hx
 Project-URL: Issues, https://github.com/aletisunil/hx/issues
 Author: Sunil Aleti
@@ -35,8 +35,8 @@ Description-Content-Type: text/markdown
 
 # HX
 
-A terminal coding agent. Python core, its own terminal renderer, OpenRouter for
-models.
+An agent harness for the terminal. Python core, its own terminal renderer,
+OpenRouter for models.
 
 HX runs in your project directory, reads and edits your code, runs commands in
 a sandboxed shell, and shows you what every turn costs.
@@ -85,13 +85,14 @@ Requires Python 3.11+. macOS and Linux. Update with `hx upgrade`.
 
 ### Credentials
 
-HX reaches models over two routes. Which one serves a turn is decided by the
+HX reaches models over three routes. Which one serves a turn is decided by the
 model id alone, so "what paid for that" is always answerable by reading it:
 
 | Model id | Route | Billing |
 |---|---|---|
 | `anthropic/claude-sonnet-4.5`, `openai/gpt-5`, … | OpenRouter | per token, API key |
 | `openai-codex/gpt-5.6-terra` | ChatGPT Plus/Pro | your subscription |
+| `devin/swe-1-6`, `devin/claude-opus-5`, … | Devin | your subscription |
 
 Credentials live in `~/.hx/auth.json`, mode 0600, one entry per route.
 
@@ -185,6 +186,38 @@ They join the `/model` picker on the next start. HX cannot ask how large an
 unknown model's context window is, so it assumes a conservative 200k — that
 costs an accurate context gauge, not the use of the model.
 
+**Devin.** Sign in with the same browser flow the official `devin` CLI uses,
+and run every model your Devin plan includes - SWE-1.6, and whatever frontier
+models the plan offers - against the subscription:
+
+```sh
+hx auth login devin             # or /login inside the TUI
+hx --model devin/swe-1-6
+hx auth logout devin
+```
+
+**Devin Enterprise** signs in the same way: on the page that opens, choose
+"Log in with Devin for Enterprise", enter your company, and finish through its
+identity provider. Your admin has to grant the "Use Devin CLI" permission first.
+Usage counts toward the organization's allocation, and an enterprise tenant
+served from its own API server is followed there for both turns and the model
+list.
+
+The browser opens to `app.devin.ai` and redirects to a loopback listener on
+`127.0.0.1:59653`. Over SSH, paste the final redirect URL into the prompt
+instead. A Devin login does not refresh: when it expires, HX says so and asks
+you to sign in again. On a machine with no browser at all, a session token in
+`HX_DEVIN_API_KEY` or `DEVIN_API_KEY` is used when nothing is saved.
+
+Signing in fetches the account's own model list, and `/model` offers exactly
+that; `/models refresh` asks again. Devin publishes each reasoning depth as a
+model of its own - Claude Opus 5 High, Claude Opus 5 Max - and HX folds each
+family into one model, so `/effort` picks the depth on Devin exactly as it does
+on Codex. A fast lane or a 1M-context lane stays a separate model, since it
+changes what a turn costs or how much fits. Router models such as
+`devin/adaptive` are resolved to a concrete model on every turn by Devin itself.
+If the list cannot be fetched, `devin/swe-1-6` and `devin/swe-1-6-fast` stand in.
+
 **Web search.** Optional, and the one credential that is not a model route.
 It powers two tools:
 
@@ -270,7 +303,7 @@ hx --system-prompt @p.md    # replace the system prompt for one run
 hx --append-system-prompt "Always run the tests"   # add to it; repeatable
 hx mcp list|add|remove      # manage MCP servers
 hx auth [set|clear]         # manage the OpenRouter key
-hx auth login [provider]    # sign in (openrouter, openai-codex)
+hx auth login [provider]    # sign in (openrouter, openai-codex, devin)
 hx auth logout <provider>   # forget a stored credential
 hx docs [section]           # the manual; no argument lists its sections
 hx changelog [version]      # what shipped in each version
@@ -807,6 +840,10 @@ OPENROUTER_API_KEY=... uv run pytest -m live tests/test_live.py
 # the Codex route draws on your ChatGPT subscription instead
 hx auth login openai-codex
 uv run pytest -m live tests/test_live_codex.py
+
+# and the Devin route on your Devin subscription
+hx auth login devin
+uv run pytest -m live tests/test_live_devin.py
 ```
 
 They are the only place the wire formats, streaming, tool use and a genuine
@@ -830,7 +867,7 @@ src/hx/
   cli.py config.py paths.py frontmatter.py git.py
   core/         loop, context assembly, compaction, late injection, sessions, usage
   auth/         credential store, OAuth flows, per-route resolution
-  providers/    OpenRouter, Codex, the model catalogue, a scripted provider for tests
+  providers/    OpenRouter, Codex, Devin, the model catalogue, a scripted provider for tests
   tools/        Bash, Read, Write, Edit, Glob, Grep, TodoWrite, Task, WebSearch,
                 WebFetch, output capping
   permissions/  rule engine, shell decomposition, Seatbelt/bubblewrap

{hx_cli-0.2.1 → hx_cli-0.2.2}/README.md

@@ -1,7 +1,7 @@
 # HX
 
-A terminal coding agent. Python core, its own terminal renderer, OpenRouter for
-models.
+An agent harness for the terminal. Python core, its own terminal renderer,
+OpenRouter for models.
 
 HX runs in your project directory, reads and edits your code, runs commands in
 a sandboxed shell, and shows you what every turn costs.
@@ -50,13 +50,14 @@ Requires Python 3.11+. macOS and Linux. Update with `hx upgrade`.
 
 ### Credentials
 
-HX reaches models over two routes. Which one serves a turn is decided by the
+HX reaches models over three routes. Which one serves a turn is decided by the
 model id alone, so "what paid for that" is always answerable by reading it:
 
 | Model id | Route | Billing |
 |---|---|---|
 | `anthropic/claude-sonnet-4.5`, `openai/gpt-5`, … | OpenRouter | per token, API key |
 | `openai-codex/gpt-5.6-terra` | ChatGPT Plus/Pro | your subscription |
+| `devin/swe-1-6`, `devin/claude-opus-5`, … | Devin | your subscription |
 
 Credentials live in `~/.hx/auth.json`, mode 0600, one entry per route.
 
@@ -150,6 +151,38 @@ They join the `/model` picker on the next start. HX cannot ask how large an
 unknown model's context window is, so it assumes a conservative 200k — that
 costs an accurate context gauge, not the use of the model.
 
+**Devin.** Sign in with the same browser flow the official `devin` CLI uses,
+and run every model your Devin plan includes - SWE-1.6, and whatever frontier
+models the plan offers - against the subscription:
+
+```sh
+hx auth login devin             # or /login inside the TUI
+hx --model devin/swe-1-6
+hx auth logout devin
+```
+
+**Devin Enterprise** signs in the same way: on the page that opens, choose
+"Log in with Devin for Enterprise", enter your company, and finish through its
+identity provider. Your admin has to grant the "Use Devin CLI" permission first.
+Usage counts toward the organization's allocation, and an enterprise tenant
+served from its own API server is followed there for both turns and the model
+list.
+
+The browser opens to `app.devin.ai` and redirects to a loopback listener on
+`127.0.0.1:59653`. Over SSH, paste the final redirect URL into the prompt
+instead. A Devin login does not refresh: when it expires, HX says so and asks
+you to sign in again. On a machine with no browser at all, a session token in
+`HX_DEVIN_API_KEY` or `DEVIN_API_KEY` is used when nothing is saved.
+
+Signing in fetches the account's own model list, and `/model` offers exactly
+that; `/models refresh` asks again. Devin publishes each reasoning depth as a
+model of its own - Claude Opus 5 High, Claude Opus 5 Max - and HX folds each
+family into one model, so `/effort` picks the depth on Devin exactly as it does
+on Codex. A fast lane or a 1M-context lane stays a separate model, since it
+changes what a turn costs or how much fits. Router models such as
+`devin/adaptive` are resolved to a concrete model on every turn by Devin itself.
+If the list cannot be fetched, `devin/swe-1-6` and `devin/swe-1-6-fast` stand in.
+
 **Web search.** Optional, and the one credential that is not a model route.
 It powers two tools:
 
@@ -235,7 +268,7 @@ hx --system-prompt @p.md    # replace the system prompt for one run
 hx --append-system-prompt "Always run the tests"   # add to it; repeatable
 hx mcp list|add|remove      # manage MCP servers
 hx auth [set|clear]         # manage the OpenRouter key
-hx auth login [provider]    # sign in (openrouter, openai-codex)
+hx auth login [provider]    # sign in (openrouter, openai-codex, devin)
 hx auth logout <provider>   # forget a stored credential
 hx docs [section]           # the manual; no argument lists its sections
 hx changelog [version]      # what shipped in each version
@@ -772,6 +805,10 @@ OPENROUTER_API_KEY=... uv run pytest -m live tests/test_live.py
 # the Codex route draws on your ChatGPT subscription instead
 hx auth login openai-codex
 uv run pytest -m live tests/test_live_codex.py
+
+# and the Devin route on your Devin subscription
+hx auth login devin
+uv run pytest -m live tests/test_live_devin.py
 ```
 
 They are the only place the wire formats, streaming, tool use and a genuine
@@ -795,7 +832,7 @@ src/hx/
   cli.py config.py paths.py frontmatter.py git.py
   core/         loop, context assembly, compaction, late injection, sessions, usage
   auth/         credential store, OAuth flows, per-route resolution
-  providers/    OpenRouter, Codex, the model catalogue, a scripted provider for tests
+  providers/    OpenRouter, Codex, Devin, the model catalogue, a scripted provider for tests
   tools/        Bash, Read, Write, Edit, Glob, Grep, TodoWrite, Task, WebSearch,
                 WebFetch, output capping
   permissions/  rule engine, shell decomposition, Seatbelt/bubblewrap

{hx_cli-0.2.1 → hx_cli-0.2.2}/install.sh

@@ -129,7 +129,7 @@ stream_text() {
 banner() {
     animate_logo
     printf '\n'
-    stream_text 'HX is a terminal coding agent that works inside your project.'
+    stream_text 'HX is an agent harness that works inside your project.'
     stream_text 'It reads and edits files, runs commands in a sandbox, and handles larger tasks with persistent sessions, skills, tools, and subagents.'
     stream_text 'Connect to models through OpenRouter and see context, cost, and usage for every turn.'
     printf '  Questions or issues? Contact \033[1;33m%s\033[0m\n\n' "$HX_SUPPORT_EMAIL"

{hx_cli-0.2.1 → hx_cli-0.2.2}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "hatchling.build"
 [project]
 name = "hx-cli"
 dynamic = ["version"]
-description = "HX - a terminal coding agent"
+description = "HX - an agent harness for the terminal"
 readme = "README.md"
 requires-python = ">=3.11"
 license = { text = "MIT" }

hx_cli-0.2.2/src/hx/__init__.py

@@ -0,0 +1,5 @@
+"""HX - an agent harness for the terminal."""
+
+__version__ = "0.2.2"
+
+__all__ = ["__version__"]

hx_cli-0.2.2/src/hx/auth/oauth/browser.py

@@ -0,0 +1,133 @@
+"""The browser half of an authorization-code sign-in, shared by every route.
+
+A route supplies the authorize URL and the loopback port it registered; this
+opens the browser, listens for the redirect, and races it against a paste
+prompt. What the route does with the code - which token endpoint, which body -
+stays in the route's own module.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import webbrowser
+from typing import Protocol
+
+from hx.auth.oauth.callback import CallbackError, CallbackResult, LoopbackCallback, parse_redirect
+
+
+class OAuthError(Exception):
+    """A sign-in that could not complete. The message is shown as-is."""
+
+
+class LoginInteraction(Protocol):
+    """How a login flow talks to whoever started it (CLI prompt or TUI modal)."""
+
+    def show_url(self, url: str, instructions: str) -> None: ...
+
+    def show_device_code(self, user_code: str, verification_uri: str) -> None: ...
+
+    def progress(self, message: str) -> None: ...
+
+    async def prompt_paste(self, message: str) -> str:
+        """Return a pasted redirect URL or code.
+
+        May never return - the browser callback usually wins the race - so
+        implementations must tolerate cancellation.
+        """
+        ...
+
+
+async def authorize_in_browser(
+    url: str,
+    *,
+    port: int,
+    path: str,
+    state: str,
+    interaction: LoginInteraction,
+    instructions: str = "",
+) -> CallbackResult:
+    """Send the user to ``url`` and return the code the provider hands back.
+
+    The callback server and the paste prompt race each other: over SSH the
+    browser opens on the wrong machine and can never reach the loopback port,
+    so pasting the final redirect URL has to work just as well.
+
+    ``instructions`` is anything route-specific the user needs to know about
+    the page they are about to see, said before the generic part.
+
+    Raises:
+        OAuthError: when the returned state is not the one sent.
+        CallbackError: when the provider reports a failure or nothing usable
+            was pasted.
+    """
+    callback = LoopbackCallback(port, path, state=state)
+    callback.start()
+    try:
+        interaction.show_url(
+            url,
+            (f"{instructions} " if instructions else "")
+            + "Complete the sign-in in your browser. On a remote machine, paste the "
+            "final redirect URL here instead.",
+        )
+        if not callback.listening:
+            interaction.progress(
+                f"Port {port} is busy, so the browser cannot hand the code back. "
+                "Paste the redirect URL here instead."
+            )
+        elif not await open_browser(url):
+            interaction.progress("Could not open a browser - open the URL above manually.")
+
+        result = await _race_callback_and_paste(callback, interaction)
+    finally:
+        try:
+            await callback.aclose()
+        except asyncio.CancelledError:
+            # Cancelled mid-teardown: finish the job on this thread rather than
+            # leaving the port bound for the life of the process, which would
+            # cost the *next* login its browser callback.
+            callback.close()
+            raise
+
+    if result.state is not None and result.state != state:
+        raise OAuthError("OAuth state mismatch - discard this login and try again.")
+    return result
+
+
+async def _race_callback_and_paste(
+    callback: LoopbackCallback,
+    interaction: LoginInteraction,
+) -> CallbackResult:
+    paste_task = asyncio.ensure_future(
+        interaction.prompt_paste("Paste the redirect URL or authorization code:")
+    )
+    wait_task = asyncio.ensure_future(callback.wait())
+    try:
+        done, _ = await asyncio.wait({paste_task, wait_task}, return_when=asyncio.FIRST_COMPLETED)
+        # Prefer the loopback result: it is the one whose state we validated.
+        if wait_task in done and not wait_task.cancelled():
+            exc = wait_task.exception()
+            if exc is None:
+                return wait_task.result()
+            if paste_task not in done:
+                raise exc
+        if paste_task in done:
+            return parse_redirect(paste_task.result())
+        raise CallbackError("Login did not complete.")
+    finally:
+        for task in (paste_task, wait_task):
+            if not task.done():
+                task.cancel()
+
+
+async def open_browser(url: str) -> bool:
+    """Open the URL without stalling the caller's event loop.
+
+    ``webbrowser.open`` is not a quick handoff: on macOS it writes AppleScript
+    to ``osascript`` and waits for it, which takes as long as the browser takes
+    to come up. On the event loop that freezes the whole TUI - including the
+    Escape that cancels the login and the field the user is meant to paste into.
+    """
+    try:
+        return await asyncio.to_thread(webbrowser.open, url)
+    except webbrowser.Error:
+        return False

{hx_cli-0.2.1 → hx_cli-0.2.2}/src/hx/auth/oauth/codex.py

@@ -21,13 +21,12 @@ import base64
 import binascii
 import json
 import time
-import webbrowser
-from typing import Any, Protocol
+from typing import Any
 from urllib.parse import urlencode
 
 import httpx
 
-from hx.auth.oauth.callback import CallbackError, CallbackResult, LoopbackCallback, parse_redirect
+from hx.auth.oauth.browser import LoginInteraction, OAuthError, authorize_in_browser
 from hx.auth.oauth.pkce import PKCE, generate_pkce, random_state
 from hx.auth.store import OAuthCredential
 from hx.net import async_client
@@ -65,28 +64,6 @@ ORIGINATOR = "hx"
 HTTP_TIMEOUT = 30.0
 
 
-class OAuthError(Exception):
-    pass
-
-
-class LoginInteraction(Protocol):
-    """How a login flow talks to whoever started it (CLI prompt or TUI modal)."""
-
-    def show_url(self, url: str, instructions: str) -> None: ...
-
-    def show_device_code(self, user_code: str, verification_uri: str) -> None: ...
-
-    def progress(self, message: str) -> None: ...
-
-    async def prompt_paste(self, message: str) -> str:
-        """Return a pasted redirect URL or code.
-
-        May never return - the browser callback usually wins the race - so
-        implementations must tolerate cancellation.
-        """
-        ...
-
-
 def authorize_url(pkce: PKCE, state: str, *, originator: str = ORIGINATOR) -> str:
     params = {
         "response_type": "code",
@@ -250,90 +227,20 @@ async def refresh(credential: OAuthCredential) -> OAuthCredential:
 
 
 async def login_browser(interaction: LoginInteraction) -> OAuthCredential:
-    """PKCE flow through the local browser, with a paste fallback.
-
-    The callback server and the paste prompt race each other: over SSH the
-    browser opens on the wrong machine and can never reach the loopback port,
-    so pasting the final redirect URL has to work just as well.
-    """
+    """PKCE flow through the local browser, with a paste fallback."""
     pkce = generate_pkce()
     state = random_state()
-    url = authorize_url(pkce, state)
-
-    callback = LoopbackCallback(CALLBACK_PORT, CALLBACK_PATH, state=state)
-    callback.start()
-    try:
-        interaction.show_url(
-            url,
-            "Complete the sign-in in your browser. On a remote machine, paste the "
-            "final redirect URL here instead.",
-        )
-        if not callback.listening:
-            interaction.progress(
-                f"Port {CALLBACK_PORT} is busy, so the browser cannot hand the code back. "
-                "Paste the redirect URL here instead."
-            )
-        elif not await _open_browser(url):
-            interaction.progress("Could not open a browser - open the URL above manually.")
-
-        result = await _race_callback_and_paste(callback, interaction)
-    finally:
-        try:
-            await callback.aclose()
-        except asyncio.CancelledError:
-            # Cancelled mid-teardown: finish the job on this thread rather than
-            # leaving the port bound for the life of the process, which would
-            # cost the *next* login its browser callback.
-            callback.close()
-            raise
-
-    if result.state is not None and result.state != state:
-        raise OAuthError("OAuth state mismatch - discard this login and try again.")
-
+    result = await authorize_in_browser(
+        authorize_url(pkce, state),
+        port=CALLBACK_PORT,
+        path=CALLBACK_PATH,
+        state=state,
+        interaction=interaction,
+    )
     interaction.progress("Exchanging the authorization code…")
     return await _exchange(result.code, pkce.verifier, REDIRECT_URI)
 
 
-async def _race_callback_and_paste(
-    callback: LoopbackCallback,
-    interaction: LoginInteraction,
-) -> CallbackResult:
-    paste_task = asyncio.ensure_future(
-        interaction.prompt_paste("Paste the redirect URL or authorization code:")
-    )
-    wait_task = asyncio.ensure_future(callback.wait())
-    try:
-        done, _ = await asyncio.wait({paste_task, wait_task}, return_when=asyncio.FIRST_COMPLETED)
-        # Prefer the loopback result: it is the one whose state we validated.
-        if wait_task in done and not wait_task.cancelled():
-            exc = wait_task.exception()
-            if exc is None:
-                return wait_task.result()
-            if paste_task not in done:
-                raise exc
-        if paste_task in done:
-            return parse_redirect(paste_task.result())
-        raise CallbackError("Login did not complete.")
-    finally:
-        for task in (paste_task, wait_task):
-            if not task.done():
-                task.cancel()
-
-
-async def _open_browser(url: str) -> bool:
-    """Open the URL without stalling the caller's event loop.
-
-    ``webbrowser.open`` is not a quick handoff: on macOS it writes AppleScript
-    to ``osascript`` and waits for it, which takes as long as the browser takes
-    to come up. On the event loop that freezes the whole TUI - including the
-    Escape that cancels the login and the field the user is meant to paste into.
-    """
-    try:
-        return await asyncio.to_thread(webbrowser.open, url)
-    except webbrowser.Error:
-        return False
-
-
 async def login_device_code(interaction: LoginInteraction) -> OAuthCredential:
     """Headless flow: show a short code, poll until the user enters it elsewhere."""
     async with async_client(timeout=HTTP_TIMEOUT) as client: