Client or integration
Direct HTTP/API client
Area
Authentication and account pool
Summary
runDevinProviderMergeStartupMigration (src/providers/devin-provider-merge-migration.ts:202, commit f7d9dba) writes the merged providers["devin"] config synchronously, then fires void rekeyProviderCredentials("devin-cli","devin") detached. getCredential is a literal slot key, so until the rekey lands — or permanently for that process if it fails (retried next boot) — resolveDevinApiServer reads an empty devin slot and falls back to the default US host. EU/FedStart tenants send their key to the wrong host in that window; GUI login status is similarly stale. The request-time TOKEN path is unaffected (resolveDevinToken uses provider.apiKey / forwarded Authorization / env, never the OAuth slot), so this is a host-selection and status-window defect, not a credential-loss defect. Collision handling refuses by design with a logged warning.
Bundled test-coverage note from the same audit: PR #4497's Pi-shape image-part regression cases cover the tool path by composition; a direct role:"tool" envelope fixture would catch a tool-branch-only regression.
Reproduction
- Configure a devin-cli OAuth credential for an EU/FedStart tenant on 2.52.0.
- Upgrade to dev @ eb81eaa and start the proxy.
- During the window between the config save and the detached rekey (or after a rekey failure), requests resolve the default US host instead of the tenant host.
Found by the 2.53.0 release regression audit (lane13, maintainer-downgraded from the lane's P1 claim after verifying the token path). Synthesis disposition: follow-up issue — self-healing, logged, retried on boot; not promotion blocking.
Version
dev @ eb81eaa (post-2.52.0, pre-2.53.0)
Operating system
macOS (any; codepath is platform-independent)
Provider and model
devin (OAuth, EU/FedStart tenants)
Logs or error output
[devin-provider-merge] credential rekey failed and will retry on the next start: ...
Screenshots and supporting files
N/A — evidence is source-level, cited inline.
Redacted configuration
providers.devin (merged from devin-cli)
Checks
Client or integration
Direct HTTP/API client
Area
Authentication and account pool
Summary
runDevinProviderMergeStartupMigration(src/providers/devin-provider-merge-migration.ts:202, commit f7d9dba) writes the mergedproviders["devin"]config synchronously, then firesvoid rekeyProviderCredentials("devin-cli","devin")detached.getCredentialis a literal slot key, so until the rekey lands — or permanently for that process if it fails (retried next boot) —resolveDevinApiServerreads an emptydevinslot and falls back to the default US host. EU/FedStart tenants send their key to the wrong host in that window; GUI login status is similarly stale. The request-time TOKEN path is unaffected (resolveDevinToken uses provider.apiKey / forwarded Authorization / env, never the OAuth slot), so this is a host-selection and status-window defect, not a credential-loss defect. Collision handling refuses by design with a logged warning.Bundled test-coverage note from the same audit: PR #4497's Pi-shape image-part regression cases cover the tool path by composition; a direct
role:"tool"envelope fixture would catch a tool-branch-only regression.Reproduction
Found by the 2.53.0 release regression audit (lane13, maintainer-downgraded from the lane's P1 claim after verifying the token path). Synthesis disposition: follow-up issue — self-healing, logged, retried on boot; not promotion blocking.
Version
dev @ eb81eaa (post-2.52.0, pre-2.53.0)
Operating system
macOS (any; codepath is platform-independent)
Provider and model
devin (OAuth, EU/FedStart tenants)
Logs or error output
[devin-provider-merge] credential rekey failed and will retry on the next start: ...
Screenshots and supporting files
N/A — evidence is source-level, cited inline.
Redacted configuration
providers.devin (merged from devin-cli)
Checks