✨ feat(devin): add end-to-end provider support - #764

Summary

Add complete end-to-end Devin provider support to CPA Manager Plus. This incorporates provider identity recognition, official branding, devin/* model namespace categorization, OAuth login lifecycle, daily/weekly quota windows and plan status tracking, Visual Config support for devin.sensitive-words obfuscation rules, extensive integration/lifecycle regression coverage, and full documentation updates.

Scope

• Frontend panel
• Manager Server
• CPA panel mode
• Full Docker mode
• Native packages / release
• Docs / Wiki
• CI / build / tooling

Changes

Stage 1: Identity & Model Namespace

• Add 'devin' to AuthFileType in apps/web/src/types/authFile.ts.
• Register official Devin light and dark SVG icons (devin.svg, devin-dark.svg) and brand theme colors.
• Implement namespace-first categorization for devin/* models in apps/web/src/utils/models.ts while preserving canonical model identifiers.
• Register Devin icon mapping in System Models view (SystemPage.tsx) and add localized filter labels across en, ru, zh-CN, and zh-TW.

Stage 2: OAuth Login Flow

• Add Devin OAuth login through CPA's management OAuth endpoints, including /devin-auth-url, /get-auth-status, /oauth-callback, and /oauth-session.
• Support full callback URL submission, state validation, polling, cancellation, reauthorization, and connection-scoped stale-response protection.
• Support localized user feedback and notifications across all OAuth lifecycle phases.

Stage 3: Quota & Plan Status

• Add live Devin quota retrieval through CPA /api-call using the credential's authIndex and server-side $TOKEN$ substitution.
• Read daily and weekly remaining percentages and exact reset timestamps from Devin GetUserStatus:
  • Daily and weekly quota reset timestamps parsed from Unix seconds with strict safe-integer/date validation.
  • Limiting window derived as min(daily, weekly).
• Parse Devin plan metadata from planStatus, including planInfo.planName, planStart, and planEnd (parsed as ISO timestamps, ignoring invalid or zero-time values).
• Reuse CPAMP's credential-scoped quota cache, persistence, refresh generation, stale-response guards, and failure-evidence retention.
• Integrate Devin quota and plan evidence into Accounts, Account Detail, and Monitoring without introducing provider-specific cache infrastructure.

Stage 4: Visual Config devin.sensitive-words

• Add Visual Config input for devin.sensitive-words in YAML configuration for sensitive-word obfuscation settings.
• Implement canonical list serialization: trim string items, filter empty strings, and preserve order.
• Maintain strict subtree isolation: preserve unknown sibling keys under devin:, and cleanly remove the devin block only when empty upon clearing.

Stage 5: Integration & Lifecycle Regressions & Documentation

• Comprehensive regression tests covering:
  • Limiting window derivation and reverse window relationships (daily > weekly).
  • Devin credential store key stability and identity binding across auth indexes.
  • Stale Devin polling response cancellation when connection changes during auth flow.
  • Canonical trimming and empty string filtering during Visual Config serialization.
• Full documentation updates across README.md, README_CN.md, Capability Matrix (capability-matrix.md), Accounts manual (accounts.md), and OAuth manual (oauth.md).

User Impact

Users can now authenticate Devin accounts via OAuth, monitor daily and weekly quota windows and plan expiration, route devin/* models with correct brand iconography, and configure devin.sensitive-words obfuscation rules directly in the visual configuration editor.

Compatibility / Runtime Notes

• Devin runtime protocol remains implemented by CPA; CPAMP does not implement Devin Connect-RPC request translation or model execution.
• OAuth uses CPA management endpoints (/devin-auth-url, /get-auth-status, /oauth-callback, /oauth-session).
• Quota uses CPA /api-call with credential-scoped authIndex and server-side $TOKEN$ substitution.
• devin.sensitive-words is edited by CPAMP but interpreted and applied by CPA.
• CPA panel mode remains supported because frontend assets are bundled into the standalone build.
• Manager Server mode: Fully compatible. Client-side normalization integrates transparently with Manager proxy endpoints.
• Full Docker / native packages: N/A (frontend and documentation expansion only).

Data / Security Notes

• OAuth/session credentials are not exposed to or persisted by the CPAMP frontend.
• Devin quota requests send only the $TOKEN$ placeholder through CPA /api-call; CPA resolves the selected credential server-side and sends the authenticated request to the Devin upstream.
• Devin quota state stores quota/plan evidence only and does not persist email, user, team, organization, or session-token data.
• Credential-scoped quota state is keyed by auth-file identity and authIndex.
• devin.sensitive-words is ordinary CPA configuration data, not credential data.

Risk / Rollback

Risk level: Medium

Rollback notes: Can be cleanly reverted via git revert without schema or server-side persistent data migration impacts.

Verification

• Type check
• Lint
• Tests
• Build
• Manual UI check
• Docs/link check
• Not applicable, docs-only

Commands / evidence:

npm run type-check
  tsc --noEmit (0 errors)

npm run lint
  eslint (0 errors, 5 pre-existing warnings)

npm run build
  tsc && vite build
  built standalone dist/index.html in 3.49s

npm run check:demo-isolation
  Default web bundle is free of demo fixture markers: apps/web/dist/index.html

npm run docs:build
  vitepress build (built in 5.64s)

npm run test:web
  Test Files: 230 passed (230)
  Tests:      3516 passed (3516)
  Duration:   41.60s

Manual UI walkthrough:
- Accounts / credential branding: verified in light/dark mode with official Devin icons
- Devin OAuth states: start, waiting, callback URL validation, cancellation, and error/success flows verified
- Account Detail & Monitoring quota presentation: daily/weekly standard windows, exact resets, and plan metadata verified
- Visual Config: devin.sensitive-words editor, item add/edit/delete, empty row handling, and whitespace trimming verified
- Localization: en, zh-CN, zh-TW, and ru verified across light/dark themes

Screenshots / Recordings

N/A — manual UI walkthrough completed locally; no visual regression requiring before/after screenshots.

Docs

• README / README_CN updated for user-visible capabilities
• Matching docs manual and navigation updated
• Demo fixtures, screenshots, and deep links reviewed
• Release notes needed
• Not needed — explanation included below

Docs decision: Complete provider capability documentation, accounts manual, OAuth manual, and capability matrix entries have been updated for Devin.

Related

N/A

Invariant Checklist

• Canonical model names preserved (devin/*)
• No sensitive word leaks; exact canonical YAML serialization
• Clean connection-fingerprint isolation for polling & caches
• Documentation synchronized (README.md, README_CN.md, apps/docs)
• Demo isolation verified
• Full test suite green (3516 tests passed)