feat(providers): add Devin CLI provider

[ThePlenkov]

Summary

Add a dedicated devin_cli provider so the orchestrator can drive the Devin CLI inside a tmux pane, alongside the existing Kiro / Claude Code / Codex providers.

This is a clean, focused replacement for #336. It contains only the Devin-provider-related changes and is rebased on the latest main.

What changed

• src/cli_agent_orchestrator/providers/devin_cli.py — new DevinCliProvider implementing BaseProvider:
  • Detects Devin TUI states (IDLE, PROCESSING, COMPLETED, WAITING_USER_ANSWER, ERROR, UNKNOWN) from ANSI-stripped pane output using Devin-specific regex patterns.
  • Extracts the agent response text from the scrollback by locating the last > user-input line and the trailing horizontal rule / status bar.
  • Builds a devin launch command with optional --agent-profile, --allowed-tools, model override, and an injected security prompt.
  • Supports MCP server configuration merging and CAO_TERMINAL_ID forwarding.
• src/cli_agent_orchestrator/models/provider.py — add DEVIN_CLI to ProviderType.
• src/cli_agent_orchestrator/providers/manager.py — register DevinCliProvider in the provider factory.
• src/cli_agent_orchestrator/utils/tool_mapping.py — register Devin's tool vocabulary (Bash, Read, Write, list, grep).
• src/cli_agent_orchestrator/services/settings_service.py — add default agent directory for devin_cli.
• src/cli_agent_orchestrator/utils/agent_profiles.py — add devin_cli -> devin source label.
• src/cli_agent_orchestrator/cli/commands/launch.py — add devin_cli to providers requiring workspace access.
• src/cli_agent_orchestrator/api/main.py — expose devin binary in GET /agents/providers.
• src/cli_agent_orchestrator/clients/tmux.py — add use_paste_buffer=False fallback to send-keys -l and shlex.quote the pipe-pane file path.
• docs/devin-cli.md — provider usage documentation.
• test/providers/test_devin_cli_unit.py + fixtures — unit tests for status detection, response extraction, tool restrictions, and registration.
• test/clients/test_tmux_send_keys.py — add test for use_paste_buffer=False.
• test/api/test_api_endpoints.py — update provider count and assert devin_cli is listed.
• test/e2e/conftest.py / test/e2e/test_supervisor_orchestration.py — add require_devin fixture and E2E supervisor orchestration scaffolding for Devin.

Why

Devin uses a fixed # prompt, a > user-input prefix, and a Mode: ... Model: ... status bar. The existing generic regex patterns do not match these markers, so a dedicated provider is needed for reliable status detection and response extraction.

The paste-buffer fallback is required because Devin's input prompt does not accept tmux's bracketed-paste sequence; sending keys literally via send-keys -l is the supported path.

[ThePlenkov]

Thanks for the review feedback on the earlier iteration (ThePlenkov#27). This clean, rebased branch incorporates the main points raised there:

• ProviderManager._create_devin_cli_provider now forwards skill_prompt to DevinCliProvider.
• tmux.send_keys validates session_name/window_name in the use_paste_buffer=False path and pipe-pane uses shlex.quote for the file path.
• MCP server merging in devin_cli.py handles null/non-dict env and normalizes mcpServers.
• File I/O in devin_cli.py uses explicit UTF-8 encoding and temp files are cleaned on success/failure.
• Response extraction preserves paragraph formatting and the prompt detection is horizontal-rule-aware.
• Duplicate E2E test method removed; Playwright tests use proper waits instead of hardcoded timeouts.
• tmux send-keys sends literal text (-l) and Enter separately.
• get_backend import for the history fallback and _wait_for_ready naming are fixed.
• fs_list category added to tool_mapping for Devin.
• NOSONAR markers added for pre-existing Sonar hotspots and user-controlled identifiers removed from herdr_backend.py logs.
• use_paste_buffer flows through BaseProvider, backend, tmux_client, and TerminalService.

This PR is rebased on the latest main and is intentionally limited to Devin CLI provider changes (25 files) to avoid the unrelated files and review noise that accumulated in the earlier PRs.

[call-me-ram]

First review — apologies this sat since 07-19. The provider scaffolding follows the cao-provider checklist closely, the temp-file handling is careful (explicit chmod 0o600 in the latest commit is the right instinct), and the e2e TestDevinCliSupervisorOrchestration with a require_devin fixture tells me this was calibrated against the real binary rather than guessed. Three blocking items, all of which I reproduced.

[must-fix] The new use_paste_buffer=False literal-keys path hard-fails above ~16 KB. tmux.py:294 passes the whole message as one argv element to tmux send-keys -l -- <keys> with check=True. tmux caps a single command message. Measured on this host (tmux 3.4):

 8000 bytes: OK
16000 bytes: OK
16500 bytes: FAIL -> command too long
20000 bytes: FAIL -> command too long
50000 bytes: FAIL -> command too long

For scale: the repo's own test/clients/test_tmux_send_keys.py:163 exercises a 50,000-byte message through the paste-buffer path, so messages well past this ceiling are an expected size here. A handoff prompt or a pasted diff will blow through 16 KB routinely, and check=True turns it into a CalledProcessError rather than a degraded send. Needs chunking, or a fallback to the buffer path above a threshold.

[must-fix] The branch reverts two merged tmux fixes. clients/tmux.py here is the pre-#430 implementation — it unconditionally hand-crafts \x1b[200~ … \x1b[201~ (tmux.py:328). On main that was replaced by a tmux-version gate (base-main tmux.py:251-260, "tmux >= 3.7 passes pasted buffer content through vis(3) sanitization"), because on tmux >= 3.7 the hand-crafted markers render as literal ^[[200~ garbage in the pane. #500 touched the same function. The branch is 31 commits behind main and DIRTY with conflicts in 4 files, so this will surface as a merge conflict — please rebase and keep main's version-gated send_keys rather than resolving in favour of this branch's copy.

[must-fix] devin_cli is in TOOL_MAPPING but missing from SOFT_ENFORCEMENT_PROVIDERS. tool_mapping.py:54 registers a devin entry, but terminal_service.py:140-144 lists only KIMI_CLI, CODEX, ANTIGRAVITY_CLI. Devin's restrictions here are advisory only — _build_security_constraint() writes prompt text and _build_command() never emits a native deny flag — so without membership in that set, the provider in SOFT_ENFORCEMENT_PROVIDERS branch at terminal_service.py:287 never fires and cao launch presents prompt-level restrictions as if they were enforced. That is a security-affordance mismatch, and it is a one-line fix.

---

Withdrawing a finding I had drafted, because it does not survive scrutiny. I was going to flag that DevinCliProvider._clean() (devin_cli.py:124) normalizes \r but not cursor motion (CUP/CHA/CUU), and that it should use the shared utils.text.strip_terminal_escapes like other providers. On checking, copilot_cli._clean() on upstream main is the same implementation — \r\n/\r → \n, then OSC, ANSI, control chars, no cursor normalization — and it ships against a similarly bottom-anchored TUI (status bar below the prompt). So this mirrors accepted upstream practice rather than deviating from it, and I have no real Devin capture showing the failure. Reducing to an optional suggestion: consider strip_terminal_escapes for robustness. But docs/devin-cli.md should be corrected regardless — it says _clean() strips things "so redraws and cursor-motion don't glue the prompt onto a previous line", and cursor motion is precisely what it does not handle.

---

Should-fix, none blocking on their own:

• submit_delay is silently ignored on the new path. The if not use_paste_buffer: branch returns before time.sleep(submit_delay) (tmux.py:347), so the value terminal_service.send_input resolves from provider.paste_submit_delay has no effect for Devin. Given #517 just landed for exactly this class of bug on antigravity, worth wiring up.
• Container path translation is a no-op for the provider's own temp files. _translate_path() is applied to the --prompt-file/--config arguments, but _write_temp_file creates them via tempfile.mkstemp() in the host temp dir, which is not covered by container.path_maps — a containerized Devin profile gets an unreadable path.
• Restricted profiles launch in Devin's default permission mode. --permission-mode dangerous --respect-workspace-trust false is added only when allowed_tools contains * (devin_cli.py:281-289), and there is no WAITING_USER_ANSWER detection path, so a restricted profile can sit on an unanswered permission prompt with nothing to notice it.
• Please split the unrelated refactors out. Commit cc636c3 rewrites ProviderManager to reflection-based construction (inspect.signature) for all 11 providers, and 81403cf changes clients/database.py:544 insert semantics. Both are plausible changes, but they put every existing provider at risk inside a PR whose stated scope is "add a new provider" — and they are the reason this PR needs a much more careful merge than a new-provider PR normally would.
• The test suite pins very little of what you iterated on. Mutation testing suggests 4 of 5 targeted behaviour changes survive with the suite green — including the horizontal-rule guard in _find_last_input_prompt, whose own docstring explains the false positive it exists to prevent. Worth adding assertions for the specific cases you hit during those 21 commits.

Nits: docs/devin-cli.md contradicts the implementation in three places; herdr log statements lost their session/window/pane identifiers; README.md loses its trailing newline; CHANGELOG.md not updated.

The provider itself looks well-built — the blocking items are mostly about the delivery-path changes it carries alongside. Rebase onto current main (keeping main's send_keys), fix the size ceiling and the enforcement-set entry, and I think this moves quickly.