feat: add first-class Devin CLI support

.agentworkforce/trajectories/compacted/compact_c0wgy00tu5ff_2026-09-20.json

@@ -0,0 +1,48 @@
+{
+  "id": "compact_c0wgy00tu5ff",
+  "version": 1,
+  "type": "compacted",
+  "compactedAt": "2026-09-20T05:55:47.761Z",
+  "sourceTrajectories": [
+    "traj_dcxgossuw06x"
+  ],
+  "dateRange": {
+    "start": "2026-09-20T05:41:06.719Z",
+    "end": "2026-09-20T05:55:47.571Z"
+  },
+  "summary": {
+    "totalDecisions": 2,
+    "totalEvents": 2,
+    "uniqueAgents": [
+      "default"
+    ]
+  },
+  "decisionGroups": [
+    {
+      "category": "security",
+      "decisions": [
+        {
+          "question": "Handle Devin word-wrapped idle placeholders after confirming installed CLI at 40 columns; use cache-only wrap credential handoff",
+          "chosen": "Handle Devin word-wrapped idle placeholders after confirming installed CLI at 40 columns; use cache-only wrap credential handoff",
+          "reasoning": "Live 3000.10.31 output wraps the exact prompt onto an indented continuation row. SDK registration already short-circuits seeded credentials, but explicit cache-only access eliminates takeover fallback even on a missing cache entry.",
+          "fromTrajectory": "traj_dcxgossuw06x"
+        }
+      ]
+    },
+    {
+      "category": "api",
+      "decisions": [
+        {
+          "question": "Count wrap retries only when injectable; override inherited worker opt-out and restrict native Devin spelling to devin/devin.exe",
+          "chosen": "Count wrap retries only when injectable; override inherited worker opt-out and restrict native Devin spelling to devin/devin.exe",
+          "reasoning": "Validated retry budget was spent on busy deferrals and stale parent RELAY_SKIP_PROMPT could disable requested MCP. portable-pty directly launches programs, so unimplemented Windows batch launchers are no longer claimed as supported.",
+          "fromTrajectory": "traj_dcxgossuw06x"
+        }
+      ]
+    }
+  ],
+  "keyLearnings": [],
+  "keyFindings": [],
+  "filesAffected": [],
+  "commits": []
+}

.agentworkforce/trajectories/compacted/compact_c0wgy00tu5ff_2026-09-20.md

@@ -0,0 +1,21 @@
+# Trajectory Compaction: Sep 19, 2026 - Sep 19, 2026
+
+## Summary
+- Sessions: 1
+- Decisions: 2
+- Events: 2
+- Agents: default
+- Files: 0
+- Commits: 0
+
+## Security
+- Handle Devin word-wrapped idle placeholders after confirming installed CLI at 40 columns; use cache-only wrap credential handoff -> Handle Devin word-wrapped idle placeholders after confirming installed CLI at 40 columns; use cache-only wrap credential handoff (traj_dcxgossuw06x)
+
+## Api
+- Count wrap retries only when injectable; override inherited worker opt-out and restrict native Devin spelling to devin/devin.exe -> Count wrap retries only when injectable; override inherited worker opt-out and restrict native Devin spelling to devin/devin.exe (traj_dcxgossuw06x)
+
+## Key Learnings
+- None
+
+## Key Findings
+- None

.agentworkforce/trajectories/compacted/compact_fiats1hqsz1w_2026-09-20.json

@@ -0,0 +1,37 @@
+{
+  "id": "compact_fiats1hqsz1w",
+  "version": 1,
+  "type": "compacted",
+  "compactedAt": "2026-09-20T07:35:59.621Z",
+  "sourceTrajectories": [
+    "traj_wgktv31za7qa"
+  ],
+  "dateRange": {
+    "start": "2026-09-20T07:32:32.259Z",
+    "end": "2026-09-20T07:35:59.393Z"
+  },
+  "summary": {
+    "totalDecisions": 1,
+    "totalEvents": 1,
+    "uniqueAgents": [
+      "default"
+    ]
+  },
+  "decisionGroups": [
+    {
+      "category": "testing",
+      "decisions": [
+        {
+          "question": "Fix CI regressions in test expectations and asynchronous PTY observation only",
+          "chosen": "Fix CI regressions in test expectations and asynchronous PTY observation only",
+          "reasoning": "All five JS failures point to omitted devin profile expectation. macOS fails fixture result assertion after a fixed 100ms sleep. Preserve 250ms submit behavior and both semantic assertions; await observed output up to 5s and keep fixture alive until shutdown.",
+          "fromTrajectory": "traj_wgktv31za7qa"
+        }
+      ]
+    }
+  ],
+  "keyLearnings": [],
+  "keyFindings": [],
+  "filesAffected": [],
+  "commits": []
+}

.agentworkforce/trajectories/compacted/compact_fiats1hqsz1w_2026-09-20.md

@@ -0,0 +1,18 @@
+# Trajectory Compaction: Sep 20, 2026 - Sep 20, 2026
+
+## Summary
+- Sessions: 1
+- Decisions: 1
+- Events: 1
+- Agents: default
+- Files: 0
+- Commits: 0
+
+## Testing
+- Fix CI regressions in test expectations and asynchronous PTY observation only -> Fix CI regressions in test expectations and asynchronous PTY observation only (traj_wgktv31za7qa)
+
+## Key Learnings
+- None
+
+## Key Findings
+- None

.agentworkforce/trajectories/compacted/compact_qfdvu5sy4t0s_2026-09-20.json

@@ -0,0 +1,48 @@
+{
+  "id": "compact_gekdxmou0hhn",
+  "version": 1,
+  "type": "compacted",
+  "compactedAt": "2026-09-20T05:37:28.642Z",
+  "sourceTrajectories": [
+    "traj_7j8hrargfgl8"
+  ],
+  "dateRange": {
+    "start": "2026-09-20T05:11:41.894Z",
+    "end": "2026-09-20T05:37:15.421Z"
+  },
+  "summary": {
+    "totalDecisions": 2,
+    "totalEvents": 3,
+    "uniqueAgents": [
+      "default"
+    ]
+  },
+  "decisionGroups": [
+    {
+      "category": "security",
+      "decisions": [
+        {
+          "question": "Use private per-worker XDG config snapshots and delayed bracketed-paste submission for Devin",
+          "chosen": "Use private per-worker XDG config snapshots and delayed bracketed-paste submission for Devin",
+          "reasoning": "Installed Devin ignores --config for MCP file relocation; XDG isolation preserved authentication in an actual probe. One-write body+Enter parked text, while a later Enter submitted. Keep user trust and approvals intact.",
+          "fromTrajectory": "traj_7j8hrargfgl8"
+        }
+      ]
+    },
+    {
+      "category": "other",
+      "decisions": [
+        {
+          "question": "Actual Devin two-message E2E passed with approval boundaries preserved",
+          "chosen": "Actual Devin two-message E2E passed with approval boundaries preserved",
+          "reasoning": "Worker devin-e2e-mu9dgnex (agent ID 227298977995862016) on isolated node node_devin-e2e-mu9dgnex in rw_7ccfea89 sent initial DM 227300144622936064. Lead follow-up 227300225157185536 was injected into the idle PTY and read at 2026-09-20T05:31:36Z. Actual Devin sent follow-up reply 227301341519724544. Lead confirmed both. Each send_dm was approved once; inbox approval was cancelled to prove PTY delivery. Production broker untouched.",
+          "fromTrajectory": "traj_7j8hrargfgl8"
+        }
+      ]
+    }
+  ],
+  "keyLearnings": [],
+  "keyFindings": [],
+  "filesAffected": [],
+  "commits": []
+}

.agentworkforce/trajectories/compacted/compact_qfdvu5sy4t0s_2026-09-20.md

@@ -0,0 +1,21 @@
+# Trajectory Compaction: Sep 19, 2026 - Sep 19, 2026
+
+## Summary
+- Sessions: 1
+- Decisions: 2
+- Events: 3
+- Agents: default
+- Files: 0
+- Commits: 0
+
+## Security
+- Use private per-worker XDG config snapshots and delayed bracketed-paste submission for Devin -> Use private per-worker XDG config snapshots and delayed bracketed-paste submission for Devin (traj_7j8hrargfgl8)
+
+## Other
+- Actual Devin two-message E2E passed with approval boundaries preserved -> Actual Devin two-message E2E passed with approval boundaries preserved (traj_7j8hrargfgl8)
+
+## Key Learnings
+- None
+
+## Key Findings
+- None

CHANGELOG.md

@@ -5,14 +5,16 @@ All notable changes to Agent Relay will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased - Patch]
+## [Unreleased - Minor]
 
 ### Fixed
 
 - `node agent attach --node` now replaces an expired remote terminal session once and reconnects existing local terminal clients, while transient terminal failures retain the bounded resume budget without minting additional sessions.
 
 ### Added
 
+- Devin CLI is available through Relay PTY, fleet and MCP spawning with isolated worker MCP configuration, preserved approvals, and reliable initial and follow-up message submission.
+
 - `agent-relay fleet nodes list --pretty` renders the fleet roster as a human-readable table; `agent-relay fleet nodes --pretty` is available as a shorter equivalent, while JSON remains the default.
 
 ## [12.3.1] - 2026-09-20

crates/broker/Cargo.toml

@@ -25,6 +25,7 @@ regex = "1.11"
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
+json5 = "0.4"
 sha2 = "0.10"
 shlex = "1.3"
 thiserror = "2.0"

crates/broker/src/cli_mcp_args.rs

@@ -391,6 +391,23 @@ mod tests {
         serde_json::from_str(&json).expect("parse output json")
     }
 
+    #[tokio::test]
+    async fn devin_defers_private_mcp_configuration_to_the_worker() {
+        let temp = tempfile::tempdir().unwrap();
+        let output = compute_mcp_args_output(command("devin", temp.path()))
+            .await
+            .unwrap();
+        assert!(
+            output.args.is_empty(),
+            "no trust or permission bypass flags"
+        );
+        assert!(output.side_effect_files.is_empty());
+        assert!(
+            !temp.path().join(".devin").exists(),
+            "never write shared project state"
+        );
+    }
+
     #[tokio::test]
     async fn claude_output_contains_resolved_mcp_config_json() {
         // The broker must render the same local executable it preflights, rather