From 8ab2c7eafb8110e50859b683b8bdd78f915242be Mon Sep 17 00:00:00 2001
From: Vocllum <149675937+Vocllum@users.noreply.github.com>
Date: Wed, 9 Sep 2026 04:12:38 +0800
Subject: [PATCH 01/17] fix(gui): keep account actions from reflowing card
 header

---
 .../components/codex-account-pool-cards.tsx   | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/gui/src/components/codex-account-pool-cards.tsx b/gui/src/components/codex-account-pool-cards.tsx
index 7c112e7a72..f395ee788d 100644
--- a/gui/src/components/codex-account-pool-cards.tsx
+++ b/gui/src/components/codex-account-pool-cards.tsx
@@ -144,6 +144,7 @@ export function CodexAccountPoolCards({
             */}
             <details
               className="codex-account-more card-right"
+              style={{ position: "relative", display: "inline-block" }}
               open={moreOpen.has(a.id)}
               onToggle={e => {
                 const open = (e.currentTarget as HTMLDetailsElement).open;
@@ -151,7 +152,23 @@ export function CodexAccountPoolCards({
               }}
             >
               <summary className="btn btn-ghost btn-sm" aria-label={`${t("codexAuth.moreActions")} — ${a.email}`} title={t("codexAuth.moreActions")}>⋯</summary>
-              <div className="codex-account-more-body">
+              <div
+                className="codex-account-more-body"
+                style={{
+                  position: "absolute",
+                  top: "calc(100% + 6px)",
+                  right: 0,
+                  zIndex: 2,
+                  width: "max-content",
+                  maxWidth: "min(680px, calc(100vw - 48px))",
+                  flexBasis: "auto",
+                  padding: 8,
+                  justifyContent: "flex-end",
+                  background: "var(--surface)",
+                  border: "1px solid var(--border)",
+                  borderRadius: "var(--radius-sm)",
+                }}
+              >
                 <span className="mono text-caption muted">{t("prov.accountId")}: {displayAccountId(a.id)}</span>
                 <button type="button" className="btn btn-ghost btn-sm" onClick={() => idCopy.copy(a.id, a.id)}>
                   {idCopy.outcomeFor(a.id) === "copied" ? t("startup.copied") : t("codexAuth.copyId")}

From 822ac4d213d407ed684dd03acdfc2ca3b8a3bcb6 Mon Sep 17 00:00:00 2001
From: Vocllum <149675937+Vocllum@users.noreply.github.com>
Date: Wed, 9 Sep 2026 04:57:03 +0800
Subject: [PATCH 02/17] fix(gui): move account disclosure layout into CSS

---
 .../components/codex-account-pool-cards.tsx   | 19 +-------------
 gui/src/styles.css                            | 25 ++++++++++++++++---
 .../codex-account-pool-toast-tone.test.tsx    | 22 ++++++++++++++++
 3 files changed, 44 insertions(+), 22 deletions(-)

diff --git a/gui/src/components/codex-account-pool-cards.tsx b/gui/src/components/codex-account-pool-cards.tsx
index f395ee788d..7c112e7a72 100644
--- a/gui/src/components/codex-account-pool-cards.tsx
+++ b/gui/src/components/codex-account-pool-cards.tsx
@@ -144,7 +144,6 @@ export function CodexAccountPoolCards({
             */}
             <details
               className="codex-account-more card-right"
-              style={{ position: "relative", display: "inline-block" }}
               open={moreOpen.has(a.id)}
               onToggle={e => {
                 const open = (e.currentTarget as HTMLDetailsElement).open;
@@ -152,23 +151,7 @@ export function CodexAccountPoolCards({
               }}
             >
               <summary className="btn btn-ghost btn-sm" aria-label={`${t("codexAuth.moreActions")} — ${a.email}`} title={t("codexAuth.moreActions")}>⋯</summary>
-              <div
-                className="codex-account-more-body"
-                style={{
-                  position: "absolute",
-                  top: "calc(100% + 6px)",
-                  right: 0,
-                  zIndex: 2,
-                  width: "max-content",
-                  maxWidth: "min(680px, calc(100vw - 48px))",
-                  flexBasis: "auto",
-                  padding: 8,
-                  justifyContent: "flex-end",
-                  background: "var(--surface)",
-                  border: "1px solid var(--border)",
-                  borderRadius: "var(--radius-sm)",
-                }}
-              >
+              <div className="codex-account-more-body">
                 <span className="mono text-caption muted">{t("prov.accountId")}: {displayAccountId(a.id)}</span>
                 <button type="button" className="btn btn-ghost btn-sm" onClick={() => idCopy.copy(a.id, a.id)}>
                   {idCopy.outcomeFor(a.id) === "copied" ? t("startup.copied") : t("codexAuth.copyId")}
diff --git a/gui/src/styles.css b/gui/src/styles.css
index a5838be7e4..a72bd57de7 100644
--- a/gui/src/styles.css
+++ b/gui/src/styles.css
@@ -1990,12 +1990,29 @@ dialog.modal-overlay::backdrop {
 .codex-pool-strategy-card .card-sub { padding: 0; }
 /* Inline selection-order row on an account card: label and trigger share one line, and the
    trigger is scaled down to the card's hint text so it reads as part of the card, not a form. */
-/* Per-account ⋯: a labelled disclosure in the action row (no menu role). Its body sits on its
-   own line under the actions so the revealed controls keep DOM tab order. */
-.codex-account-more { display: inline-flex; flex-wrap: wrap; align-items: center; }
+/* Per-account ⋯: a labelled disclosure in the action row (no menu role). Keep the details
+   wrapper inline so opening the body cannot add a flex item to the card header; the revealed
+   controls are an anchored panel and retain their DOM tab order. */
+.codex-account-more { position: relative; display: inline-block; }
 .codex-account-more > summary { list-style: none; cursor: pointer; min-width: 28px; justify-content: center; }
 .codex-account-more > summary::-webkit-details-marker { display: none; }
-.codex-account-more-body { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; flex-basis: 100%; padding-top: 6px; }
+.codex-account-more-body {
+  position: absolute;
+  top: calc(100% + 6px);
+  right: 0;
+  z-index: 2;
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  width: max-content;
+  max-width: min(680px, calc(100vw - 48px));
+  padding: 8px;
+  justify-content: flex-end;
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+}
 .codex-account-identity { display: flex; align-items: center; justify-content: space-between; gap: 8px; padding: 0 16px 6px; min-width: 0; }
 .codex-account-identity-copy { font-size: var(--text-label); line-height: var(--leading-body); color: var(--muted); min-width: 0; overflow-wrap: anywhere; }
 .codex-account-priority { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; padding: 0; min-width: 0; flex: 0 0 auto; }
diff --git a/gui/tests/codex-account-pool-toast-tone.test.tsx b/gui/tests/codex-account-pool-toast-tone.test.tsx
index 5e64bed40a..6aeca89759 100644
--- a/gui/tests/codex-account-pool-toast-tone.test.tsx
+++ b/gui/tests/codex-account-pool-toast-tone.test.tsx
@@ -573,3 +573,25 @@ test("a pool card with a non-default order keeps its order select inline", async
   expect(card.querySelector<HTMLDetailsElement>("details.codex-account-more")!.open).toBe(false);
   expect(card.querySelector("#codex-account-priority-pool-1")).not.toBeNull();
 });
+
+test("the more-actions disclosure uses one anchored CSS panel without a flex-basis row break", async () => {
+  const source = await Bun.file(new URL("../src/components/codex-account-pool-cards.tsx", import.meta.url)).text();
+  const css = await Bun.file(new URL("../src/styles.css", import.meta.url)).text();
+  const wrapper = /\.codex-account-more\s*\{([^}]*)\}/.exec(css)?.[1] ?? "";
+  const body = /\.codex-account-more-body\s*\{([^}]*)\}/.exec(css)?.[1] ?? "";
+
+  // The layout contract belongs to the stylesheet so a later refactor cannot leave an
+  // inline declaration silently winning over the old flex rule.
+  expect(source).toContain('className="codex-account-more card-right"');
+  expect(source).toContain('className="codex-account-more-body"');
+  expect(source).not.toContain('style={{ position: "relative", display: "inline-block" }}');
+  expect(source).not.toContain('flexBasis: "auto"');
+
+  expect(wrapper).toMatch(/position:\s*relative/);
+  expect(wrapper).toMatch(/display:\s*inline-block/);
+  expect(body).toMatch(/position:\s*absolute/);
+  expect(body).toMatch(/top:\s*calc\(100% \+ 6px\)/);
+  expect(body).toMatch(/right:\s*0/);
+  expect(body).toMatch(/max-width:\s*min\(680px, calc\(100vw - 48px\)\)/);
+  expect(body).not.toMatch(/flex-basis:/);
+});

From beb5cdb3041a18ca32fce257594a037682c66831 Mon Sep 17 00:00:00 2001
From: Vocllum <149675937+Vocllum@users.noreply.github.com>
Date: Wed, 9 Sep 2026 05:35:50 +0800
Subject: [PATCH 03/17] fix(gui): keep default priority inside actions panel

---
 .../components/codex-account-pool-cards.tsx   | 29 ++++++++++---------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/gui/src/components/codex-account-pool-cards.tsx b/gui/src/components/codex-account-pool-cards.tsx
index 7c112e7a72..f2864724bf 100644
--- a/gui/src/components/codex-account-pool-cards.tsx
+++ b/gui/src/components/codex-account-pool-cards.tsx
@@ -82,6 +82,20 @@ export function CodexAccountPoolCards({
         const inCooldown = oauthHealthIsCooldown(healthStatus);
         const healthLabel = formatOAuthHealthLabel(t, a.health);
         const healthSummary = formatOAuthHealthSummary(t, "codex", a.id, a.health);
+        const hasCustomPriority = normalizeAccountPriority(a.priority) !== DEFAULT_ACCOUNT_PRIORITY;
+        const priorityControl = (
+          <AccountPriorityControl
+            value={a.priority}
+            selectId={`codex-account-priority-${a.id}`}
+            // Every row, not just the one being written: the controller serializes order
+            // writes behind one mutation ref, so a second row's pick would come back "busy"
+            // and be dropped with no toast. Same global lock the pause button uses.
+            // A pending switch counts too — it writes the same pin this clears, so the
+            // controller refuses to overlap them, and that refusal is equally silent.
+            disabled={priorityUpdatingId !== null || switchingId !== null}
+            onChange={(priority) => onPriorityChange(a, priority)}
+          />
+        );
         return (
         <div key={a.id} className={`card ${isNext(a) ? "card-active" : ""}`} style={{ marginBottom: 8 }}>
           <div className="card-head">
@@ -152,6 +166,7 @@ export function CodexAccountPoolCards({
             >
               <summary className="btn btn-ghost btn-sm" aria-label={`${t("codexAuth.moreActions")} — ${a.email}`} title={t("codexAuth.moreActions")}>⋯</summary>
               <div className="codex-account-more-body">
+                {!hasCustomPriority && priorityControl}
                 <span className="mono text-caption muted">{t("prov.accountId")}: {displayAccountId(a.id)}</span>
                 <button type="button" className="btn btn-ghost btn-sm" onClick={() => idCopy.copy(a.id, a.id)}>
                   {idCopy.outcomeFor(a.id) === "copied" ? t("startup.copied") : t("codexAuth.copyId")}
@@ -173,19 +188,7 @@ export function CodexAccountPoolCards({
           </div>
           <div className="codex-account-identity">
             <div className="codex-account-identity-copy">{a.email}{a.plan ? ` · ${a.plan}` : ""}</div>
-            {(normalizeAccountPriority(a.priority) !== DEFAULT_ACCOUNT_PRIORITY || moreOpen.has(a.id)) && (
-            <AccountPriorityControl
-              value={a.priority}
-              selectId={`codex-account-priority-${a.id}`}
-              // Every row, not just the one being written: the controller serializes order
-              // writes behind one mutation ref, so a second row's pick would come back "busy"
-              // and be dropped with no toast. Same global lock the pause button uses.
-              // A pending switch counts too — it writes the same pin this clears, so the
-              // controller refuses to overlap them, and that refusal is equally silent.
-              disabled={priorityUpdatingId !== null || switchingId !== null}
-              onChange={(priority) => onPriorityChange(a, priority)}
-            />
-            )}
+            {hasCustomPriority && priorityControl}
           </div>
           {healthSummary && (
             <div className="card-sub faint">{healthSummary}</div>

From f36d1a52f2f9786368f3ec65780dc6cab85f1cef Mon Sep 17 00:00:00 2001
From: Vocllum <149675937+Vocllum@users.noreply.github.com>
Date: Wed, 9 Sep 2026 05:36:21 +0800
Subject: [PATCH 04/17] fix(gui): render priority only while disclosure is open

---
 gui/src/components/codex-account-pool-cards.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gui/src/components/codex-account-pool-cards.tsx b/gui/src/components/codex-account-pool-cards.tsx
index f2864724bf..b0ea42bf88 100644
--- a/gui/src/components/codex-account-pool-cards.tsx
+++ b/gui/src/components/codex-account-pool-cards.tsx
@@ -166,7 +166,7 @@ export function CodexAccountPoolCards({
             >
               <summary className="btn btn-ghost btn-sm" aria-label={`${t("codexAuth.moreActions")} — ${a.email}`} title={t("codexAuth.moreActions")}>⋯</summary>
               <div className="codex-account-more-body">
-                {!hasCustomPriority && priorityControl}
+                {!hasCustomPriority && moreOpen.has(a.id) && priorityControl}
                 <span className="mono text-caption muted">{t("prov.accountId")}: {displayAccountId(a.id)}</span>
                 <button type="button" className="btn btn-ghost btn-sm" onClick={() => idCopy.copy(a.id, a.id)}>
                   {idCopy.outcomeFor(a.id) === "copied" ? t("startup.copied") : t("codexAuth.copyId")}

From f7391941ed8c190d9c73b3f8abc116efaa5b8168 Mon Sep 17 00:00:00 2001
From: Vocllum <149675937+Vocllum@users.noreply.github.com>
Date: Wed, 9 Sep 2026 05:47:45 +0800
Subject: [PATCH 05/17] test(gui): pin account priority disclosure placement

---
 ...x-account-more-priority-placement.test.tsx | 115 ++++++++++++++++++
 1 file changed, 115 insertions(+)
 create mode 100644 gui/tests/codex-account-more-priority-placement.test.tsx

diff --git a/gui/tests/codex-account-more-priority-placement.test.tsx b/gui/tests/codex-account-more-priority-placement.test.tsx
new file mode 100644
index 0000000000..77fbee8c06
--- /dev/null
+++ b/gui/tests/codex-account-more-priority-placement.test.tsx
@@ -0,0 +1,115 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { Window } from "happy-dom";
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { CodexAccountPoolCards } from "../src/components/codex-account-pool-cards";
+import type { CodexAccountEntry } from "../src/components/codex-account-pool-types";
+import { LanguageProvider } from "../src/i18n/provider";
+
+const globals = ["document", "window", "navigator", "localStorage", "IS_REACT_ACT_ENVIRONMENT"] as const;
+type GlobalName = (typeof globals)[number];
+
+let previous: Record<GlobalName, PropertyDescriptor | undefined>;
+let testWindow: Window;
+let root: Root | null = null;
+let host: HTMLElement;
+
+function restoreProperty(target: object, key: PropertyKey, descriptor: PropertyDescriptor | undefined): void {
+  if (descriptor) Object.defineProperty(target, key, descriptor);
+  else Reflect.deleteProperty(target, key);
+}
+
+beforeEach(() => {
+  previous = Object.fromEntries(
+    globals.map(key => [key, Object.getOwnPropertyDescriptor(globalThis, key)]),
+  ) as typeof previous;
+  testWindow = new Window({ url: "http://localhost/" });
+  Object.defineProperties(globalThis, {
+    document: { configurable: true, value: testWindow.document },
+    window: { configurable: true, value: testWindow },
+    navigator: { configurable: true, value: testWindow.navigator },
+    localStorage: { configurable: true, value: testWindow.localStorage },
+    IS_REACT_ACT_ENVIRONMENT: { configurable: true, value: true },
+  });
+  host = testWindow.document.createElement("div") as never as HTMLElement;
+  testWindow.document.body.appendChild(host as never);
+});
+
+afterEach(async () => {
+  if (root) await act(async () => root?.unmount());
+  root = null;
+  for (const key of globals) restoreProperty(globalThis, key, previous[key]);
+  await testWindow.happyDOM?.close?.();
+});
+
+function account(priority: number): CodexAccountEntry {
+  return {
+    id: "pool-1",
+    email: "pool@example.test",
+    isMain: false,
+    paused: false,
+    priority,
+    hasCredential: true,
+    quota: null,
+    quotaAutoRefresh: {
+      fiveHourAvailable: false,
+      weeklyAvailable: false,
+      fiveHourEnabled: false,
+      weeklyEnabled: false,
+    },
+  };
+}
+
+async function mount(priority: number): Promise<void> {
+  await act(async () => {
+    root = createRoot(host);
+    root.render(
+      <LanguageProvider>
+        <CodexAccountPoolCards
+          pool={[account(priority)]}
+          activeId={null}
+          accountModeState={null}
+          switchActionLabel="Switch"
+          threshold={80}
+          onOpenReset={() => undefined}
+          onSwitch={() => undefined}
+          onTogglePause={() => undefined}
+          pauseUpdatingId={null}
+          pauseBusy={false}
+          onPriorityChange={() => undefined}
+          priorityUpdatingId={null}
+          switchingId={null}
+          pinnedId={null}
+          onReauth={() => undefined}
+          onEditAlias={() => undefined}
+          onRemove={() => undefined}
+        />
+      </LanguageProvider>,
+    );
+  });
+}
+
+test("default priority selector is rendered inside the open more-actions panel", async () => {
+  await mount(0);
+  const more = host.querySelector<HTMLDetailsElement>("details.codex-account-more");
+  expect(more).not.toBeNull();
+  expect(host.querySelector("#codex-account-priority-pool-1")).toBeNull();
+
+  await act(async () => {
+    more!.querySelector<HTMLElement>("summary")!.click();
+    await new Promise<void>(resolve => testWindow.setTimeout(resolve, 0));
+  });
+
+  expect(more!.open).toBe(true);
+  expect(more!.querySelector("#codex-account-priority-pool-1")).not.toBeNull();
+  expect(host.querySelector(".codex-account-identity #codex-account-priority-pool-1")).toBeNull();
+});
+
+test("non-default priority selector stays inline and out of the closed disclosure", async () => {
+  await mount(2);
+  const more = host.querySelector<HTMLDetailsElement>("details.codex-account-more");
+  expect(more).not.toBeNull();
+  expect(more!.open).toBe(false);
+  expect(more!.querySelector("#codex-account-priority-pool-1")).toBeNull();
+  expect(host.querySelector(".codex-account-identity #codex-account-priority-pool-1")).not.toBeNull();
+});

From 453027336d34986b23f63d30ac3e71e40fd1c40e Mon Sep 17 00:00:00 2001
From: Vocllum <149675937+Vocllum@users.noreply.github.com>
Date: Wed, 9 Sep 2026 05:52:06 +0800
Subject: [PATCH 06/17] test(gui): assert one priority control per account

---
 ...dex-account-more-priority-placement.test.tsx | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/gui/tests/codex-account-more-priority-placement.test.tsx b/gui/tests/codex-account-more-priority-placement.test.tsx
index 77fbee8c06..4fb49dddc3 100644
--- a/gui/tests/codex-account-more-priority-placement.test.tsx
+++ b/gui/tests/codex-account-more-priority-placement.test.tsx
@@ -8,6 +8,7 @@ import { LanguageProvider } from "../src/i18n/provider";
 
 const globals = ["document", "window", "navigator", "localStorage", "IS_REACT_ACT_ENVIRONMENT"] as const;
 type GlobalName = (typeof globals)[number];
+const prioritySelector = "#codex-account-priority-pool-1";
 
 let previous: Record<GlobalName, PropertyDescriptor | undefined>;
 let testWindow: Window;
@@ -89,11 +90,11 @@ async function mount(priority: number): Promise<void> {
   });
 }
 
-test("default priority selector is rendered inside the open more-actions panel", async () => {
+test("default priority selector is rendered once inside the open more-actions panel", async () => {
   await mount(0);
   const more = host.querySelector<HTMLDetailsElement>("details.codex-account-more");
   expect(more).not.toBeNull();
-  expect(host.querySelector("#codex-account-priority-pool-1")).toBeNull();
+  expect(host.querySelectorAll(prioritySelector)).toHaveLength(0);
 
   await act(async () => {
     more!.querySelector<HTMLElement>("summary")!.click();
@@ -101,15 +102,17 @@ test("default priority selector is rendered inside the open more-actions panel",
   });
 
   expect(more!.open).toBe(true);
-  expect(more!.querySelector("#codex-account-priority-pool-1")).not.toBeNull();
-  expect(host.querySelector(".codex-account-identity #codex-account-priority-pool-1")).toBeNull();
+  expect(host.querySelectorAll(prioritySelector)).toHaveLength(1);
+  expect(more!.querySelector(prioritySelector)).not.toBeNull();
+  expect(host.querySelector(`.codex-account-identity ${prioritySelector}`)).toBeNull();
 });
 
-test("non-default priority selector stays inline and out of the closed disclosure", async () => {
+test("non-default priority selector is rendered once inline and out of the closed disclosure", async () => {
   await mount(2);
   const more = host.querySelector<HTMLDetailsElement>("details.codex-account-more");
   expect(more).not.toBeNull();
   expect(more!.open).toBe(false);
-  expect(more!.querySelector("#codex-account-priority-pool-1")).toBeNull();
-  expect(host.querySelector(".codex-account-identity #codex-account-priority-pool-1")).not.toBeNull();
+  expect(host.querySelectorAll(prioritySelector)).toHaveLength(1);
+  expect(more!.querySelector(prioritySelector)).toBeNull();
+  expect(host.querySelector(`.codex-account-identity ${prioritySelector}`)).not.toBeNull();
 });

From c73d644c3deac337db7ce996d02e3bceb7817372 Mon Sep 17 00:00:00 2001
From: Vocllum <149675937+Vocllum@users.noreply.github.com>
Date: Wed, 9 Sep 2026 18:15:05 +0800
Subject: [PATCH 07/17] fix(gui): align account actions with popover styling

---
 gui/src/styles-codex-set.css | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/gui/src/styles-codex-set.css b/gui/src/styles-codex-set.css
index 25daedcd68..764a96660f 100644
--- a/gui/src/styles-codex-set.css
+++ b/gui/src/styles-codex-set.css
@@ -441,3 +441,19 @@
 .codex-main-hard-lock-dialog .modal-desc { text-wrap: pretty; }
 :lang(ko) .codex-main-hard-lock-copy .card-sub,
 :lang(ko) .codex-main-hard-lock-dialog .modal-desc { word-break: keep-all; }
+
+/* Account-card ⋯ actions share the dashboard's compact popover language instead of
+   reading as a wide floating toolbar. This selector intentionally outranks the later
+   single-class rule in styles.css without moving layout ownership back inline. */
+.codex-account-more .codex-account-more-body {
+  box-sizing: border-box;
+  z-index: var(--z-popover);
+  min-width: min(16rem, calc(100vw - 2rem));
+  max-width: min(22rem, calc(100vw - 2rem));
+  padding: 10px 12px;
+  gap: 6px;
+  justify-content: flex-start;
+  background: var(--raised);
+  border-radius: var(--radius);
+  box-shadow: 0 4px 24px rgb(0 0 0 / 0.14);
+}

From 96f074cb828ba9da6b94fbb08778cd6b29bb3c1a Mon Sep 17 00:00:00 2001
From: Vocllum <149675937+Vocllum@users.noreply.github.com>
Date: Wed, 9 Sep 2026 18:15:17 +0800
Subject: [PATCH 08/17] test(gui): pin compact account actions popover

---
 .../codex-account-more-popover-style.test.ts  | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 gui/tests/codex-account-more-popover-style.test.ts

diff --git a/gui/tests/codex-account-more-popover-style.test.ts b/gui/tests/codex-account-more-popover-style.test.ts
new file mode 100644
index 0000000000..f15d1b4575
--- /dev/null
+++ b/gui/tests/codex-account-more-popover-style.test.ts
@@ -0,0 +1,19 @@
+import { expect, test } from "bun:test";
+
+function ruleBody(css: string, selector: string): string {
+  const escaped = selector.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`${escaped}\\s*\\{([^}]*)\\}`).exec(css)?.[1] ?? "";
+}
+
+test("account more-actions uses the compact dashboard popover language", async () => {
+  const css = await Bun.file(new URL("../src/styles-codex-set.css", import.meta.url)).text();
+  const body = ruleBody(css, ".codex-account-more .codex-account-more-body");
+
+  expect(body).toMatch(/z-index:\s*var\(--z-popover\)/);
+  expect(body).toMatch(/min-width:\s*min\(16rem, calc\(100vw - 2rem\)\)/);
+  expect(body).toMatch(/max-width:\s*min\(22rem, calc\(100vw - 2rem\)\)/);
+  expect(body).toMatch(/background:\s*var\(--raised\)/);
+  expect(body).toMatch(/border-radius:\s*var\(--radius\)/);
+  expect(body).toMatch(/box-shadow:\s*0 4px 24px rgb\(0 0 0 \/ 0\.14\)/);
+  expect(body).toMatch(/justify-content:\s*flex-start/);
+});

From 91c7e9d0d408f60692928bb8899a609f5c2fc1c3 Mon Sep 17 00:00:00 2001
From: Vocllum <149675937+Vocllum@users.noreply.github.com>
Date: Wed, 9 Sep 2026 18:16:43 +0800
Subject: [PATCH 09/17] refactor(gui): own account popover layout in codex
 styles

---
 gui/src/styles-codex-set.css | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/gui/src/styles-codex-set.css b/gui/src/styles-codex-set.css
index 764a96660f..d23ac05799 100644
--- a/gui/src/styles-codex-set.css
+++ b/gui/src/styles-codex-set.css
@@ -457,3 +457,21 @@
   border-radius: var(--radius);
   box-shadow: 0 4px 24px rgb(0 0 0 / 0.14);
 }
+
+/* Layout ownership lives here too. The type-qualified selectors outrank the legacy
+   single-class declarations later in styles.css, so the disclosure stays out of card flow
+   even after styles.css is refreshed from upstream. */
+details.codex-account-more {
+  position: relative;
+  display: inline-block;
+}
+
+details.codex-account-more > .codex-account-more-body {
+  position: absolute;
+  top: calc(100% + 6px);
+  right: 0;
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  flex-basis: auto;
+}

From 21cefec3d5cfa2dd8241df6c3daab30cb2522e27 Mon Sep 17 00:00:00 2001
From: Vocllum <149675937+Vocllum@users.noreply.github.com>
Date: Wed, 9 Sep 2026 18:16:55 +0800
Subject: [PATCH 10/17] test(gui): cover account popover layout ownership

---
 .../codex-account-more-popover-style.test.ts  | 25 +++++++++++++------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/gui/tests/codex-account-more-popover-style.test.ts b/gui/tests/codex-account-more-popover-style.test.ts
index f15d1b4575..ed968a3f0f 100644
--- a/gui/tests/codex-account-more-popover-style.test.ts
+++ b/gui/tests/codex-account-more-popover-style.test.ts
@@ -7,13 +7,22 @@ function ruleBody(css: string, selector: string): string {
 
 test("account more-actions uses the compact dashboard popover language", async () => {
   const css = await Bun.file(new URL("../src/styles-codex-set.css", import.meta.url)).text();
-  const body = ruleBody(css, ".codex-account-more .codex-account-more-body");
+  const wrapper = ruleBody(css, "details.codex-account-more");
+  const layout = ruleBody(css, "details.codex-account-more > .codex-account-more-body");
+  const visual = ruleBody(css, ".codex-account-more .codex-account-more-body");
 
-  expect(body).toMatch(/z-index:\s*var\(--z-popover\)/);
-  expect(body).toMatch(/min-width:\s*min\(16rem, calc\(100vw - 2rem\)\)/);
-  expect(body).toMatch(/max-width:\s*min\(22rem, calc\(100vw - 2rem\)\)/);
-  expect(body).toMatch(/background:\s*var\(--raised\)/);
-  expect(body).toMatch(/border-radius:\s*var\(--radius\)/);
-  expect(body).toMatch(/box-shadow:\s*0 4px 24px rgb\(0 0 0 \/ 0\.14\)/);
-  expect(body).toMatch(/justify-content:\s*flex-start/);
+  expect(wrapper).toMatch(/position:\s*relative/);
+  expect(wrapper).toMatch(/display:\s*inline-block/);
+  expect(layout).toMatch(/position:\s*absolute/);
+  expect(layout).toMatch(/top:\s*calc\(100% \+ 6px\)/);
+  expect(layout).toMatch(/right:\s*0/);
+  expect(layout).toMatch(/flex-basis:\s*auto/);
+
+  expect(visual).toMatch(/z-index:\s*var\(--z-popover\)/);
+  expect(visual).toMatch(/min-width:\s*min\(16rem, calc\(100vw - 2rem\)\)/);
+  expect(visual).toMatch(/max-width:\s*min\(22rem, calc\(100vw - 2rem\)\)/);
+  expect(visual).toMatch(/background:\s*var\(--raised\)/);
+  expect(visual).toMatch(/border-radius:\s*var\(--radius\)/);
+  expect(visual).toMatch(/box-shadow:\s*0 4px 24px rgb\(0 0 0 \/ 0\.14\)/);
+  expect(visual).toMatch(/justify-content:\s*flex-start/);
 });

From 65cf58bdd461f57ffcc83180a3b1a1d2c951d0d9 Mon Sep 17 00:00:00 2001
From: Vocllum <149675937+Vocllum@users.noreply.github.com>
Date: Wed, 9 Sep 2026 20:33:22 +0800
Subject: [PATCH 11/17] test(gui): drop stale account popover assertion

---
 .../codex-account-pool-toast-tone.test.tsx    | 22 -------------------
 1 file changed, 22 deletions(-)

diff --git a/gui/tests/codex-account-pool-toast-tone.test.tsx b/gui/tests/codex-account-pool-toast-tone.test.tsx
index 6aeca89759..5e64bed40a 100644
--- a/gui/tests/codex-account-pool-toast-tone.test.tsx
+++ b/gui/tests/codex-account-pool-toast-tone.test.tsx
@@ -573,25 +573,3 @@ test("a pool card with a non-default order keeps its order select inline", async
   expect(card.querySelector<HTMLDetailsElement>("details.codex-account-more")!.open).toBe(false);
   expect(card.querySelector("#codex-account-priority-pool-1")).not.toBeNull();
 });
-
-test("the more-actions disclosure uses one anchored CSS panel without a flex-basis row break", async () => {
-  const source = await Bun.file(new URL("../src/components/codex-account-pool-cards.tsx", import.meta.url)).text();
-  const css = await Bun.file(new URL("../src/styles.css", import.meta.url)).text();
-  const wrapper = /\.codex-account-more\s*\{([^}]*)\}/.exec(css)?.[1] ?? "";
-  const body = /\.codex-account-more-body\s*\{([^}]*)\}/.exec(css)?.[1] ?? "";
-
-  // The layout contract belongs to the stylesheet so a later refactor cannot leave an
-  // inline declaration silently winning over the old flex rule.
-  expect(source).toContain('className="codex-account-more card-right"');
-  expect(source).toContain('className="codex-account-more-body"');
-  expect(source).not.toContain('style={{ position: "relative", display: "inline-block" }}');
-  expect(source).not.toContain('flexBasis: "auto"');
-
-  expect(wrapper).toMatch(/position:\s*relative/);
-  expect(wrapper).toMatch(/display:\s*inline-block/);
-  expect(body).toMatch(/position:\s*absolute/);
-  expect(body).toMatch(/top:\s*calc\(100% \+ 6px\)/);
-  expect(body).toMatch(/right:\s*0/);
-  expect(body).toMatch(/max-width:\s*min\(680px, calc\(100vw - 48px\)\)/);
-  expect(body).not.toMatch(/flex-basis:/);
-});

From 9c9a0c8d6487c26bc1512216fdeeaf607dea9577 Mon Sep 17 00:00:00 2001
From: Vocllum <149675937+Vocllum@users.noreply.github.com>
Date: Thu, 10 Sep 2026 20:02:50 +0800
Subject: [PATCH 12/17] chore(gui): reconcile account card with current dev

---
 gui/src/components/codex-account-pool-cards.tsx | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/gui/src/components/codex-account-pool-cards.tsx b/gui/src/components/codex-account-pool-cards.tsx
index b0ea42bf88..8817ed1616 100644
--- a/gui/src/components/codex-account-pool-cards.tsx
+++ b/gui/src/components/codex-account-pool-cards.tsx
@@ -80,6 +80,7 @@ export function CodexAccountPoolCards({
         const healthStatus = a.health?.status;
         const showReauth = Boolean(a.needsReauth) || oauthHealthShowsReauth(healthStatus);
         const inCooldown = oauthHealthIsCooldown(healthStatus);
+        const validationPending = a.health?.reason === "validation_pending";
         const healthLabel = formatOAuthHealthLabel(t, a.health);
         const healthSummary = formatOAuthHealthSummary(t, "codex", a.id, a.health);
         const hasCustomPriority = normalizeAccountPriority(a.priority) !== DEFAULT_ACCOUNT_PRIORITY;
@@ -115,13 +116,13 @@ export function CodexAccountPoolCards({
                 <span className={oauthHealthBadgeClass(healthStatus)}>{healthLabel}</span>
               )}
               {showReauth && !healthLabel && <span className="badge badge-amber">{t("codexAuth.needsReauth")}</span>}
-              {isNext(a) && !showReauth && !inCooldown && (
+              {isNext(a) && !showReauth && !inCooldown && !validationPending && (
                 <span className="badge badge-primary">
                   {t(accountModeState === "direct" ? "codexAuth.poolPrepared" : "codexAuth.nextSession")}
                 </span>
               )}
             </span>
-            {!a.paused && (!isNext(a) || pinnedId !== a.id) && !showReauth && !inCooldown && (
+            {!a.paused && (!isNext(a) || pinnedId !== a.id) && !showReauth && !inCooldown && !validationPending && (
               <button type="button" className="btn btn-ghost btn-sm codex-account-switch" onClick={() => onSwitch(a)}>
                 {switchActionLabel}
               </button>

From a776728385df199e93a65bcb4dfe128867880ebf Mon Sep 17 00:00:00 2001
From: Vocllum <149675937+Vocllum@users.noreply.github.com>
Date: Fri, 11 Sep 2026 18:54:13 +0800
Subject: [PATCH 13/17] docs(pr): add synthetic account-actions preview

---
 .../account-actions-popover-synthetic.jpg        | Bin 0 -> 9729 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 .github/pr-assets/account-actions-popover-synthetic.jpg

diff --git a/.github/pr-assets/account-actions-popover-synthetic.jpg b/.github/pr-assets/account-actions-popover-synthetic.jpg
new file mode 100644
index 0000000000000000000000000000000000000000..21e9e806ac92d93329d1dc514a4ee952a8a0fa4a
GIT binary patch
literal 9729
zcmd6L1zgly)9{~^TBJon>FyF?kq+rDDM7kJN`a+C8tIT+x<jNFmo9-tN)QAT5b01r
z;9K;0?$vvL?|tumzwi4!@0{5=bLPy<nUniJ=VJO|5g<^MyDJBvpa1|0G65HF0cn7o
zfQXdnDmf`JDaCbiDtb{SdKwyf1%4rRQ5_{ieQhO84HLU?casMYOASrW94|;zTuNHX
zJ=elo=(FnZ#FT_fCn(n`DClp}%Q7*^CfwJ&pYV_2;uS!Mg+hYbiiSc5pc0~>5u#jl
z0oReCUIOqtprE3mV<4-@{vbzcprBsN0(fXB04f0*0kU|!_`BIp9GW3)12L#3vna+b
zD7wJ2y_#EYvyr)SxH=?e^cB&zAM?%^1qhU2c}n*r?=MNt?@npRG~Pz5&VyS_rn^L~
z(V!pD1U7sSMh!vwBK^<Cy7AM3ebPjg@jZUG_`!Ls=DOy(5df$tW-lBD3$aDr`TnT#
zQyJT=7(mS_X2S{k+XMhGqgwE}Mpw3ke{%E-OA<;ry=+~+*XGZIl>c>?f2!r=8y%G9
z#G9py5X1rigS;EhhBhYl+6=&32m5XGLkB+a3hPL3b#;($Eae+D`ZphG>+pA$4%}}y
zBO>c>i>|Dodhle8aKWF#ev1Z0VRRS|0#J-Zv})<0<!5mnYx(r84~%c5aXIqUNVL7g
z-+!_>fLSX@gP?b(_X+laV7Ep{JN#x30QzhgiG2V{`C0~Sokv6&KgJ?Ib^hZmpJ+Z2
zYnq?*kZjr9eoGAg%<UGfkb3wS{<T)&=3UMn7?7+*17HMwl6I#pj~<FF2YvsA)e7_>
z=#``S{>w}g2f5<1@EWkCSki-Xa*~i^LIUIgsIY2QI+zY}Emb4i<WdZRVoLxdA#CaZ
z(DpL2-2%EI(6^C^{Wej|U>`9CULN1Ss+T0ekOu(B74>9ep+^kSC1$uAYq@*X>nVQA
z{-p2jHRIL~2jJzxulRF00A{TiH_yQ;<e(Lf0587*zf#X?!k$V!RO8v`fdHtLATg4C
zH5G89KHKMym;I-q0Z=R{M*0Q#ZJyGrM=BdKRM)BZUDo^ts5!{~BNv#oax}l<FgqRe
z(gZW=1&;&VrN0gYXU_-0nWE}{O#gqA!7V^hLOkyj)_AHR0Ps&1ZZR7&Amk|h1)yFI
z@m~TBaIp*EpaTE|0+HyH03a}lANn#15+Nb5E-b7lJZ*9U0)?R*D)A!-Dj*>NNJ_Nt
zK5j4;2t_C_7a<OJ^J7%$BltNU!e8LHsW#i*>MDu`r>Njw)g$bQYIf<swmhmG<nC0w
zp@Pi0EK@F?+pevf*E$z8EJ4GM-PTWDj_^Mjmb<H@-=ACbSbL?}?Ky}_x`%kZGq>x*
zd-7dgkMkBoMHK}>idZN840$HGV@h7@gj;<p173YjMj4cK&Y(TUy2sIJ?Q%1eD@xIO
zw+1(g>e~@pveGoM1BDI|LX;QDDTBe|zVZaKj`m+ID}%?<>~H1<VbT0g@knpwT6K%-
z9Wc>Ng{63pDln0746Vmdv+E4ogulYFaCaDopSaRy4ByMp(A`MvK}nAlV}3O~Vm`Re
z{4#YiyDF0_Z*c$&6tl59?76_w%N)@z_31&3a&%gXM%^=dPw*;{O4zsK>wUx1`>r!W
z(Y1^tGnAI14;<rP$kaJRICs7{HE6e*@gq9kH_i!@MCZeLK+yLc<rk{51!pWVdyvqT
zL5Tzt_=8Ef`w`z=h6J_h_QzB6c4?)8a>bEvC@QA|>doa)d&w(mFLXY0XA92WWv)+9
zvt@Wbepjp@0cr4GV73z$P0Wsb`tgxX-cy#pf$aOy+4CfNzT$;u>m1jUn@{LReXo>T
zB)s`{+AlO4{{HOom)IrK=4Sy0FTmac<~wBG`3_goy$6iNc5ij{GRDod8r_zT*^7{#
zyw;Wb&ByHhb`*GuY0bxc&u7UwYCFm@-O)OtIcEK+ms9gK`CIZ&g3pc|I$*e)5y`d%
zJNlb}nT|6ZFb2so+PFTe@-RufFlm}FX(B=TU0fC+A%^McXBHL~cGJ^NcNv`g$A9!X
zK*PAK+j~rwMB{Iw$<_0A<YvN@kpN)G^b^P!0VL!<b`MNK4d#<??%U0y&wT+C-vuzx
zkvr-aVECa4L27EmA|2v(0e~bR5eRg4{-!FUpezH#DUgtu$wZOk#gQ9PnF*_B7BD!t
z1pL^fD6z1nCF*X!aCrx&l)5I&uiNRa#sqq6ULyC^>s+nc2)*0MnM2P_h1<Epp0}jP
zhnS8BF+Wub>Xsp|9UNdH{6Z^ZQcy~kO&IRhZxVo!Y+xDlA*NktY1e|xl&i|MO6i5^
zrjvZIgM1#Dt1W?@Rd$W|^^zkgGISO8>KJ;?=i`#2Nu(P0dCpZLMQb)W8*r+gudo!C
z$v!6<l<M(|<T4HPuL##1q)e*oL>>Nc^S<x3P}S0nkB(tOWVbDvEK9sQ=mtMD^qM4<
zPtpgr%POS026(;h-m4%~3DrKqR&{W&vm(+E>x_GTZKXQ1CS66LdQG*|c$kl&=)h4f
zW&J{>!VpwxCZA|~lSoc4xFepPLI=MmK^%s*^H}C9D}%?P>Q_zYHGix_BGp&bS+exU
zT$dw_JO^QbL?;q2Pr~oBf*fgWBN+ny2g+D9HtHng0*`sTjc7RjHOzooU%;c!oLXDm
zjQ-NBtM~^>GS)HpXSRbmiT7D&XB7&VGH&x8pNFJykE&aiTTizyyJj~UVR$>~2r`B<
z@SrmJ@MXDUf%$ziPdo8m%ntX`8ON~Z^_OYCb3Y?b?C*e~6PyXXI!Eiw-seBJj0j+y
zJ4@O==31@Y@*iyaT(YpIm+!q=##e7HJk4kPdS-CXcp+XOxNmyHZwoqimbS3J`-&ih
z7E9`HkN{5OTX|Iw2tt&CNre;)$2FY#%&4<AWGw51Gn5sztUIjiBsJyO8&5$iEJ2;J
z=oy;t6?pK%%Owmk@{p*Gp#zmtsp;m+J3*jPvd=9^vXAlCs?Oj_??(G+w;W0=eb1WC
zx>wTLVifc@`1B+f7L9q8f<l!_lHV;qY#!SDWJj34j44n>fqh$`Xz}(?#Zzj-l;#7U
zYk9kcm?vymhG~x9Ko2rT2kmx*3Nl=;ANmT^?)cn`KJez7J@C;#YtebCHKbc_*{9V3
z1DbV>W9diJN^6<?(kM2+vD)v--VfHwD6X;nLZ{ne%BX$L8jOiY&STd3H?xx;ssSse
zjd1>%xr%=Ot|~a4;qK?z21?yoO^~4A<gw@lhH_Ygr|6UJ>o-Vz4O{DqJL0CUFu2M8
z-y`GamA1_IeyV@tqubop-(@Lv2}f=wBT6&<k8aZ^+@>wrv0MJ?z^tMb5Zn?IF+)NP
zElr4aeCcU|866k)cF(YzXW^v}*69Ox54QFzY9Q^DmLRwIyvJHN?pS4$p{pt~G2$hd
zr60nQgDSfD3Sf|eVBrJ%5|WY7&xJdR=dX_7s>`#r?@!OeUes@26;#!G4;sr*#jMX{
zFIqjJFf=di%+*bY8<d0msFzhktOe$`1eE#F`@;|JIlVe_1WBfYzfsS5Y&oL@!`Vbi
zK7!-mS8EL&7)$i><_Gf6dtL^qoq>!#B^(Hb<<QG~Hrcp?(|leq_-U#FbFgV%G_AsL
z9`kvE${cNbdRrxWeQi(JLy<%9d)oN2E!z*l(;97)y;<v5MGXb>o%~3-y_A!Qh77M)
zAk;YU8%;VYOyy$5uXs@t3(R$XB+Ue4r?*Avdb9Nj^1T2D!v+?0pD_onI3zgQF<U(7
zNuN6M{$<as=fCcp?^O`!`v#)$42tQg00m4dEnM*j*;|1O9fZB{<Kc}M44Nd+;P92&
z{?p(9iT4v7S^{_Qx9+f>hEk|ukT%n56c1(f&qITXye@#-HyXD1GzC=TOJb$9e8^<)
zl9kvm-mlhgj$~Xf3)UPY&4@7Ze_`XkV|VIdEbk@~(L3RdJ(3SorNY0076@B(5&mzP
z=*Z<I^QSCPF{<5uRyL0Xy=14)QY?;)V`n_YE&q40Ne*YJGv5;1aTnWhG!xs5wv1%I
z;bMsRqv<j(h{elupI}>a5*n+${5a^#us2y{E=T?P>lR0kgCwUF_aRx#+m;JJO3mrK
z1r%Ydc|?1Ku5n9NMf70+&W3<4-(B)&PK>6pdE%HsDhY-)g$-Jz#0AKcka$C9EnK&F
zN=i4YL{amgL)F&~?Y#%|j7r%0DRRo0b-4pQB%W&I<>?nHrY}C|Cz<3%o#bUbOZ`;g
z?bR__$}YlOBe$`Yl|g7HMi62nguDTWro}zNj_-9RdKIhTNoiZZV4-8KeL%5?{2*u|
zt7Nu<7rq|3a&Saw3=()C<dU48&aY%dzC02di|68LxafB3)R}$(ys4oQ6+&QkjZ1U!
z3*8VEgf8nLI%FB0Wk<^?=7R67>W>(fyInJR&J0&3O<i;?4XTn=96Z6~4t!h>-B8p_
z?5Gv8@w9sR@f9@ru@8S(bSrOz5T*0|clBSTMh!PG1j9!JkM-Lz#zeJuZqV}TdxzI7
z?q2I(0?R*fXp1%uD|pw9IoLPDaXyCpv&had|9VY9;551<U%C-90^~{S9diTcZ5w5K
zPZ*z&9pC$;Xqkas46zcD?7HzpC@Zpgs4$f(^NkoWDpj#-u#P9lLDVGQv49=kf#0|S
zY3Pr|1mjDIrXnRPB-^LcKfZTR=6Zu~V7<I{{)Br8chR(qtV8YJ&l3O|QiXv3HF*DL
z900VCMHrrWEP;7Ac`ih9e~1T;_b2@BUE(|43k9QH!J-KP(}oj3zDs^0EYD!TUMI(2
zT%k~u@b>@Qz$<_Nj=ahu8>Zqx#uH0!@pF)uJl?+|k0GyCLn{2*i%SI#o?avshU3wo
zTm|n#umDMPhB$yG7#)y62T-wievcCUJqWxPO77Mx%ts7#VgYb;0!b{M%f6uftLHmc
zkP1{<!@_Z}-_0&LJf8g#a9lL97QEj{wF}4N9sFgmcrPOXQ1J!!FfL=DK>-91$V)ju
zfPzN@0RSlgzy(*sIcR#Z_94Jt2!Mvg0}Z9xfdCQ!0f5c}L4GY^Bip^~-CiKx9)utv
z5G(%In=;bF<qVDp?{_1002*m@8l>Al0US@DQw<s9FX8=hUSp9#{>k!Zff{)4=i;Au
zl-FS7vls;-fQt6(gBc;9?jmW1Tzgn3$Qp5ieU;$|Gp-66Tr_i$+8weB0BJ@-`12dv
zrSG`!2B?<?a^gr0b^_$P8VVX38v4KeqX2}oyc&U$_v2m1b_i&4cX?{m%{nFCe>X%v
zFNzaf079L%IX8JAnz0z#7}HqIWK+r`g}GNWsg^KC-%wyAFARo+mrjgVorYxv3L5(J
zKfe_mT0hNmz^jO*O{|M^{(+?Gk(OiZ@tJfnJp<gc*T$yz$`XnV&W)T-uGVJE*HY>_
zaRha~LoNi1*3^&Q(b<I{UqnzX_V5FPlKkTp^P**^4t)|2*gid=T{wqA9Yb@<({6=D
zL-K02$IVVIa+2w4ACebCYqxNW1$|)>JOWsTn^pIwNM#jmUEO_d#YK^<kLqUJ&#^9G
z!;%XQ6d3nR=O(q_m$sLReDo?kz&&9SosL#Og&4yyCeD^*!?o6}_`btPQ}UFDE?xY@
zr$EzJxSVf?8lCy(TL(S&|HJIUb?2zYo_oujyP4pT8`f9(!_(kH??1Zi3;X;K@U?*l
z4))m*Lse>*?3Pc`+&+8LN4=snljoLRmvw9%kV(_Mosl~ou?GFOnHg3xpC!1d-tE6F
z4#T0Cynvy+SwEmC8{ep>Dd#hZhMb%6yEm{!mNt*k1ra4qqd~u<?WZc(D<Q@iS@c<{
zG3;A`;%+C>M*pz5VxBS#B3t;CYYk=|_3yYp?KJlg;@TaBVXz{~dWp_U(;fX6(kv(O
zV?KX@)KiLZh!=ClF=WwQd2)AplI=DOL@j%9Pv(urjAxjX2>F;X<1<AfI9pPY6|G92
z&_>M1xc(aiU<ec~o@{XiR|un^a=x#En-bTJ^1Op@y~}0lYlnhVf#N9VmYz+p33*i(
zw2jl{=u0vqiS*+~16<?7Dh)?Z0_Bax>?p(ng3A!=6K5$;SQYKERIKErO5yC~!{O|m
z8LZ#X-+V4>YFyI9R`j($8^Dup?_orTxOgB4(VS^>Mx9U7>l3!AX2aw#)tPNtbk3?y
z&CCecaS$J1>#1Ieih(tP%=hMXF~te{nKIRepE`-dt`p}vu+@>&nd`<HH>OP{)KYjY
zq+XY6l=!%PnoPc=<5+YCQ3q8<%|9Z*DUZZKn0jJ<y&xBe8Giv(-QGagVO2>ROG}<%
zN2uBG)2{Vo?Z}FhZGdice4i;oV)UB^>9w1HG!tY{fQ_rN#+9a+ngo8Hl)G`Yb!v?+
zrp)=)4*h7o`omi;5E4a%;j2|MkiPhJYsKbor00qD--I51Q`$<I=WaIjXkYgmKZSnz
ze_k|rcbR_i&$0b$;(ce)+UpauPyJDJ$SZaGm*Vs6&t3-|JLnD+9}OD6W8G~Pk8{+|
z8qQ<&_=+0P+^~)G3^G04grOE5X)9gK=+&YppHS?Ujl!3<)N_fT(r-zhPyj{-raO3g
z`kxL{=Tql*d0Un&yt;a}Bcd0GDchNDJyv%5`X3ReZZBDMM8ur`gAj;@7m#=vwkX^*
ze^eAFeLeM>G})Uvfmw_^JoeQ)@f&85<p^mz!SvYuhKmgR+UN_Se<LyCs|;tA)*Z6P
z9A6D~>fT$wdL5dL`~S7bJrVimW-bUX;W0<!g~3jZplwsp&O=WQx3}3VC8mCgo9y+K
z<1Kz{8cn=^N-T3HQw2RM|4#Yt7dBka!Y5KJFijV#CQdj<xtb?;wBMGd#9dU&tBZMV
z8t2#$TBOJqnB52LRj+nw*H%Z2DI~YCywqWIC%1>NIy88$dW-V=mMemr66093`=02P
zx!jwzUA8nA3Y1iC*w^3I$#yj#ZPP0dI)sd8Y*fZYlcC6p&2`D^Lk9g$c@a_SeKdz&
z5LWu4a@DuCM~(H8B*C(|zF&Ic?<6D};0uPaVQ4pl#*FhPbPzqYODL>}T(5UDSh^%1
z-}w8gV9F8>tbK#Jk2+U-d}Je;^(qS*W}^*?oJzG7;h;@qwynJLlujG2CDq_$hYFV&
zm|%QDSIk97g!5^bsdVAueo#(mlEFs3tZLn<T6X|uht?XJ&@FQ|4*=DdX9|}ycUUK-
zkmi94F1~=9GdfP#kn_E%N#ibZGpZLU8!QKTop}pc{G2Q{nB;jOGbLHNqc#ZnL#}0E
z7K-s8HmeJreG09YaNab|(#<b=dgC+&sZz}X6@>-YS>&6o1J&0;(*s=H?Euac+k$nC
zB#lWxlKSZJODr@ULzuvucK5C0U_?bTO4!>~j-J$;3?xs5EL8j!cy+YznY>j?w)XK*
z0*O5h6SKBeffaA8ZLnJ`u|(Ru$c{5w_<{;Mp?mn$(GJ6M>cTu})^?V&t!Swu*tFz8
zr1W8hzY(Ew*vlu$?<^GRqeUj`1nDx_%LQTc55_f#LTWt9A}Up`S-EoA)Y%1-=~PSz
zj*(iXpU6;d<{EaEX5>X%nBhf+%ovVx>4Mo#!{`JEw*taBXMKxGf5+8I-+$qEA++(t
zpN+!r<V+1JYh>mOeU~sXQ)mzM5FH9E&u#C-OG*ngNpY>d7hEV*k$2B-bdASzlj?mw
z=!@TUE>I!kyXxKw3>TvwJ$hErWZ!TKmsaO&uP5prpEr1|z(xU3^UFGJbFyQXdO3u`
zB41>g-!nR4ioSV_=HPPyn)(`IZ(!WP*Wz#K`R%pV(1E|D&^K6H`=<MT-}i{P<+SQp
zXHG6jVw(KAW18xa%tT^s7BVkbKc|@p(-ai8%?*8hYh#jSu}IYoHceEbnHhSb6eiKU
zl;z^9eIsW8@}aq_3fFBkgOD>>H~nGHvl8K`96|wM%L75S6}iD?(umT0x--q@ZH|0x
zYEEOzg-I*P2gZD+WW@A>l@!Bo8xK*VaHgDdbA6}YmS@L=FO)x2_rqenZk%SE+Gv+m
zsAol&$<LEex!1x&f`)C2+~9mIJce2vhDHVBtRzom>Eaa%H2;dBjw%bv*4plmSW}bo
zC7>*<GTNZl(s^_EJcMtscfLG*xb{SPyV+qP#hTlyXzd2#;HvG(mHIQZS^vOIafzes
zoJVS-V*l$a=x0H@)>Rkc(KbT|*_I}0>(A5HX}uIra<xt6@(a{AGU3}(1o_aD5$sN3
zX7t5O;vg5*f5dkE(MGDg6LeodXx+<O9LABGFWXohMv`RNnEQ60<QC{)tboK=P$^p+
zCWIao_T_vuUSh*R0!_N&@F+Fsf#L0P?Fk7qqWlUfpLI6IP_9FwqiY4&A|wr5q+n(q
zWv-?1v9n4W1l=Lm>`uwUP?Vha9$r>daf;V+*i9PzX$WFI<EWmbMzAW?Pp^yIRL!L7
zs=aydRPau=x{_0f&GLk0zXPuSkfGJsHeQP&Xy%?}eVu8pQ`4rH`xG1Dh*oRiUPf)k
zfHP6{OGf_4PVZ#YNRHa_pi;6nRE8@|Pq`^ah(q2BE7{oNN81Za-pf~h8SFb!BYoGt
zP>ivyRc7p&Q4%SIjf$(V>J6H=jdOMZlnH4Y-z4NlJ-TGki$~YgOqYBwh^M|jZ|pie
zr@=ft*<i}M8K74*s^Z%)^(X|Dr6#v#*jEPcy4`p;b(Qy?g9tIMYlkO6EBPnFzDYSD
z4Ken{abDZ%sTR8m=(iXcsbbmPN!KZLj6xnGnE`hl8$Y55YZMC^1{n@>X2}Vr<T>YZ
zO0=SJiGu1BtEB4n(U|LPm?Jq8E>Yg9m1Agj1Bk}Esd44>au-4&I2De&*~ec*psjLP
zh6Z|g)u<0g7jkh(+eoAimW&@ts2m_aKKZh(6qiVKj5V|9qheEWC@IQ820P_P!FLA&
zp`_<a#f`er_rG)%RCu(v)_bcFy$?#AwLW(RS?l;=LgbFx?u02|V7-a8A#5oizgNGf
zxLyx*=1}Z(Vg?@HiK&{kQ?1E2><Ka-a|yK_8>92BsX&)3z-K(7eRlJ8d3r3=Z{8#u
zR%YOO*cgx#&A61EQ_yJZG(Hb)QSwaQ{IaCc!ZM%eG;qt3vNn1~?sL8;Qn1Zqd(f5N
z5h1r7@tef?^&GM#zB%JE8Fkd;yoOoR2}3_-2lEdhY!z%PRFiI5k7bBmF}6I%t4au2
zMq4qyikF-rBn1U$Z(%vhiUq*H+uxe|i_h_^)bicT5bgHoovs1AD9+Jlkod76GP9|V
z7|JDmuD&v#-g%5O>y+J(*>-+zHgauw(n)>nxSxB%2HH*7;4r5NXl_0ke--IO_Rv(V
z_X`?bc-cAm)LQ6J<>w!%3fUAze{q)od6ilofPq6c<*Hl7c~EuA8N{Q$`SiYy?l9+i
zy+cU>$iNBeyP(v(&n`)-eViC=a(p~#Uckub%=-+r<)~yF=ba~uIE<kr^)L<4`Lb!c
z$3n{T@Yr>Nvx%F*1uNg@@MTb-%KSxmqruwqh(BPY#!eG5y(IgrY*A_bYSFe;BWC}-
ztKoI!$%pB&i=PfI<a>G}qGO3EZ!ll^kuwQ_)q0B%8s8|g)pAQeoerFhLnU=n*pC#?
zMh%JxvLZ~I^|nGv%huHy&&NAFs^&4Lh=uw`+%s2i{}aMG;FekRD|v5NpL7cKUjw4$
zcZ`+A3U4tp^sMB&UEWA}n~>Mje-)zp{}ZX7WiG`qpjv0i?Bequ56ype=Khb4YQ;A3
SV6FA@-0utb5OlTi;{O1b_Ha1>

literal 0
HcmV?d00001


From 6a6bcc6ae79457ee0ab8eca41f2b2594dca2b81e Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 13 Sep 2026 00:15:05 +0900
Subject: [PATCH 14/17] fix(devin-cli): harden the imported CLI session against
 path, read, and cache defects (#4418)

* docs(devlog): plan Devin hardening and the cached-token companion

Locks the roadmap for the devin-cli token transition, the cloud-direct transport and usage decode, and the cached-token display companion, before any implementation lands.

* docs(devlog): fold the roadmap audit findings into the Devin hardening plan

An independent review of the first draft failed it on three counts. Field 7 needs its own uint64 decoder and must suppress field 28 within a message, because both arrive together and the adapter last-writes usage. The input-versus-cache mapping is derived from the frame rather than assuming Cognition is exclusive, since guessing wrong inflates input and bills cache at the uncached rate. And missing_ui_screenshot is path-based on gui/src, so the display phase carries a real screenshot instead of avoiding the word.

* fix(devin-cli): harden the imported CLI session against path, read, and cache defects

Five defects on the credential-import path.

An empty APPDATA or XDG_DATA_HOME resolved to a cwd-relative credentials path, because `??` treats an empty string as a set value; a file planted beside the proxy would have imported as the operator's own CLI session.

Every read failure collapsed into `undefined`, so a permission error on an existing file was reported as 'not signed in' and sent the operator to `devin auth login`, which does not fix it. The outcome is now missing, unreadable, incomplete or ok, each with its own message, and the parse is bounded at 64 KiB.

A bare JWT in Metadata.api_key went out without the `devin-session-token$` prefix and came back as an opaque permission_denied, which reads as a revoked account rather than a malformed credential. Only a three-segment JWT is reshaped, so a Codeium UUID, an sk-ws key and a cog_ key pass through untouched.

Logout cleared the shared user-JWT and catalog cache only for provider `devin`, and account deletion never cleared it, so a CLI-imported key's JWT outlived its own logout. Both ids now clear on both paths.

redactSecretString recognised neither a Devin session token nor a bare JWT, and a Connect trailer can quote the request that carried one.
---
 .../_plan/260912_devin_hardening/000_plan.md  | 63 ++++++++++++++
 .../010_cli_token_transition.md               | 53 +++++++++++
 .../020_cloud_direct_hardening.md             | 78 +++++++++++++++++
 .../030_cached_token_display.md               | 54 ++++++++++++
 .../040_stacked_delivery.md                   | 24 +++++
 src/adapters/devin/cloud-direct/metadata.ts   | 33 ++++++-
 src/lib/redact.ts                             |  7 ++
 src/oauth/devin-cli.ts                        | 87 ++++++++++++++-----
 src/server/management/oauth-account-routes.ts | 36 ++++++--
 tests/lib/redact.test.ts                      | 23 +++++
 tests/providers/devin-cli-login.test.ts       | 72 +++++++++++++++
 tests/providers/devin-hardening.test.ts       | 33 +++++++
 12 files changed, 533 insertions(+), 30 deletions(-)
 create mode 100644 devlog/_plan/260912_devin_hardening/000_plan.md
 create mode 100644 devlog/_plan/260912_devin_hardening/010_cli_token_transition.md
 create mode 100644 devlog/_plan/260912_devin_hardening/020_cloud_direct_hardening.md
 create mode 100644 devlog/_plan/260912_devin_hardening/030_cached_token_display.md
 create mode 100644 devlog/_plan/260912_devin_hardening/040_stacked_delivery.md

diff --git a/devlog/_plan/260912_devin_hardening/000_plan.md b/devlog/_plan/260912_devin_hardening/000_plan.md
new file mode 100644
index 0000000000..ff3681761c
--- /dev/null
+++ b/devlog/_plan/260912_devin_hardening/000_plan.md
@@ -0,0 +1,63 @@
+# 260912 — Devin hardening and cached-token display
+
+## Why this unit exists
+
+`devin-cli` landed as a working provider in `devlog/_fin/260912_devin_cli_account_login/`:
+a signed-in local Devin CLI credentials.toml is imported as an OAuth account, and inference
+goes to the Cognition cloud endpoint through the cloud-direct adapter rather than through an
+ACP stdio loop. That unit proved the path works. It did not harden it.
+
+Two things are outstanding.
+
+The first is the auth and transport path itself. The import reads one file with two regexes,
+the session token has no modelled expiry, and the cloud-direct client's failure classification
+is thin enough that an operator cannot tell a revoked credential from a rate limit from a
+protocol drift. The adapter decodes a reverse-engineered protobuf frame, and a truncated or
+reshaped frame is a class of failure the current code does not name.
+
+The second is unrelated to Devin and was raised alongside it: a cached request's token total
+is displayed without its cached companion on several surfaces. The logs table already renders
+a total with a stacked cached line, and the surfaces that do not do this look like they are
+reporting a different number rather than the same number without its breakdown.
+
+## Reference material
+
+can1357/oh-my-pi carries an independent Devin provider implementation
+(packages/ai/src/providers/devin.ts, packages/ai/src/usage/devin.ts,
+packages/catalog/src/discovery/devin.ts, packages/catalog/src/wire/devin.ts) plus generated
+proto descriptors for the same Cognition surface. It is cloned read-only into .tmp/ref/oh-my-pi
+and is never vendored, imported, or copied: it is a second observation of the same wire
+protocol, used to decide which of our assumptions are load-bearing and which are guesses that
+happened to hold. Its open pull requests are read the same way.
+
+## Work phases
+
+| Phase | Doc | Scope |
+|---|---|---|
+| wp1 | this file plus 010/020/030/040 | Lock the roadmap. Docs only. |
+| wp2 | 010_cli_token_transition.md | CLI credential import and token transition hardening. |
+| wp3 | 020_cloud_direct_hardening.md | Cloud-direct transport, usage, and catalog hardening. |
+| wp4 | 030_cached_token_display.md | Cached companion on every total-bearing surface. |
+| wp5 | 040_stacked_delivery.md | Stacked PR chain, exact-head CI, merge into dev. |
+
+wp2 and wp3 are sequential because they share src/oauth/devin/api-base.ts and the account
+record shape. wp4 is independent of both and touches only gui/src and src/cli, so it is a
+sibling branch in the stack rather than a child.
+
+## Out of scope
+
+- The Devin session product (cog_ keys, agent VMs). credentials.toml carries devin_webapp_host
+  and devin_api_url for it; neither is inference and neither is read.
+- Any change to src/adapters/devin-cli/acp.ts stdio behaviour beyond failure classification.
+  The cloud-direct route is the one that serves traffic.
+- Vendoring anything from the reference clone.
+
+## Constraints carried into every later phase
+
+- Bun-native TypeScript. No Node-only API that Bun does not implement.
+- bun run privacy:scan stays green. A devin session token is not recognised by
+  redactSecretString, so no error path may echo a request body or a parsed credential.
+- Behaviour changes in src/ get a focused regression test next to the existing
+  tests/providers/devin-*.test.ts files.
+- Every new test file needs an entry in scripts/test-layout/layout.json and
+  tests/fixtures/test-layout-expected.json.
diff --git a/devlog/_plan/260912_devin_hardening/010_cli_token_transition.md b/devlog/_plan/260912_devin_hardening/010_cli_token_transition.md
new file mode 100644
index 0000000000..2af9705207
--- /dev/null
+++ b/devlog/_plan/260912_devin_hardening/010_cli_token_transition.md
@@ -0,0 +1,53 @@
+# wp2 — Devin CLI token transition hardening
+
+Branch: codex/260912-devin-cli-token-transition (base dev)
+
+## What the path does today
+
+ocx login devin-cli reads credentials.toml from the CLI data dir, pulls windsurf_api_key and
+api_server_url with two line regexes, validates the host, and stores an OAuth account whose
+expiry is Number.MAX_SAFE_INTEGER and whose refresh throws invalid_grant. Inference then runs
+through the cloud-direct Connect client, not through core's OAuth replay path.
+
+## Defects to fix
+
+1. The session token prefix is never normalized. Every Cognition RPC expects
+   devin-session-token$<JWT>. A credential arriving without it (OPENCODEX_DEVIN_TEST_TOKEN, a
+   pasted bare JWT, a provider apiKey typed by hand) is sent verbatim and returns an opaque
+   permission_denied, which reads as a revoked account rather than a malformed credential.
+   oh-my-pi normalizes at the metadata boundary (packages/catalog/src/wire/devin.ts). We do
+   not. Fix: one normalizer applied where Metadata.apiKey is built, plus a unit test.
+
+2. An empty APPDATA or XDG_DATA_HOME resolves to a cwd-relative path.
+   src/oauth/devin-cli.ts uses env.APPDATA ?? join(homedir(), ...), and "" is a set value, so
+   join("", "devin", "credentials.toml") yields devin/credentials.toml relative to whatever
+   directory the proxy runs in. A file planted there imports as the operator's CLI session.
+   Fix: treat an empty or whitespace-only value as unset.
+
+3. The credential file is read whole with no bound and every I/O failure collapses to
+   "not signed in". EACCES, EISDIR, and a missing file are indistinguishable, so the one error
+   message the caller owns cannot name the actual recovery step. Fix: cap the read, and
+   separate missing from unreadable without putting file bytes into any thrown value.
+
+4. Logout clears the shared user-JWT and catalog cache only for provider "devin".
+   src/server/management/oauth-account-routes.ts gates the clear on that exact id, so logging
+   out of devin-cli leaves a cached api_key-bearing JWT in process memory for its whole TTL,
+   and account deletion never clears it at all. devin and devin-cli share the same cache.
+   Fix: cover both provider ids on both paths.
+
+5. A Connect EOS trailer message is echoed verbatim into the client error and /api/logs.
+   The HTTP-status paths deliberately refuse to echo bodies because a Connect error can quote
+   the request that carries the key; the trailer path then does the opposite. redactSecretString
+   recognises neither devin-session-token$... nor a bare JWT. Fix: add both patterns to the
+   redactor so anything that does reach a log is masked.
+
+## Non-goals
+
+The app.devin.ai PKCE CLI OAuth flow. The import path is the intended substitute and a second
+login protocol is its own unit. Also excluded: probing the key at import time, which changes
+login latency and deserves its own decision.
+
+## Verification
+
+bun test tests/providers/devin-cli-login.test.ts tests/providers/devin-cli-authmode-migration.test.ts tests/providers/devin-hardening.test.ts
+plus bun run privacy:scan.
diff --git a/devlog/_plan/260912_devin_hardening/020_cloud_direct_hardening.md b/devlog/_plan/260912_devin_hardening/020_cloud_direct_hardening.md
new file mode 100644
index 0000000000..726c5e181e
--- /dev/null
+++ b/devlog/_plan/260912_devin_hardening/020_cloud_direct_hardening.md
@@ -0,0 +1,78 @@
+# wp3 — Devin cloud-direct hardening
+
+Branch: codex/260912-devin-cloud-direct-hardening (base codex/260912-devin-cli-token-transition)
+
+## 1. Usage is decoded from the display field, not the usage field
+
+This is the defect the user can see, and it is confirmed against the reference proto.
+
+decodeUsageBlock in src/adapters/devin/cloud-direct/chat.ts treats GetChatMessageResponse
+field 28 as a usage block keyed by metric-id strings. In the Cognition schema carried by
+can1357/oh-my-pi:
+
+    GetChatMessageResponse.usage                      = 7   (ModelUsageStats)
+    GetChatMessageResponse.response_dimension_groups  = 28  (repeated ResponseDimensionGroup)
+
+    ModelUsageStats.input_tokens       = 2   uint64 varint
+    ModelUsageStats.output_tokens      = 3   uint64 varint
+    ModelUsageStats.cache_write_tokens = 4   uint64 varint
+    ModelUsageStats.cache_read_tokens  = 5   uint64 varint
+
+Field 28 is not an older usage shape. It is the current display message:
+ResponseDimensionGroup is {title, dimensions}, and ResponseDimension.uid is field 5 — which is
+exactly the sub-field today's decoder reads as metric_id. So the existing decoder works by
+reading presentation rows whose uid happens to spell the metric, and it yields cache numbers
+only when the server chose to render cache rows. Field 7 carries them unconditionally.
+
+Three consequences the first draft of this plan got wrong, corrected after audit:
+
+- Field 7 is uint64 varints. The existing entry walker only descends length-delimited
+  sub-messages and reads a fixed32 float, so it cannot read field 7 at all. Field 7 needs its
+  own decoder.
+- "Decode both, field 7 wins" is not what decoding both produces. Both fields arrive in the
+  same response and src/adapters/devin.ts replaces usage on every usage event, so a naive
+  addition lets field 28 land last and win. Within one message, field 7 must suppress
+  field 28 outright; field 28 stays only as the fallback for a message that carries no field 7.
+- The adapter must merge usage fields across events rather than replacing the object, so a
+  later partial frame cannot zero an earlier input count.
+
+## 2. Whether input_tokens already includes cache is not known, so do not assume it
+
+This repository's convention is inclusive: inputTokens covers the whole prompt, cachedInputTokens
+is the read subset, and totalTokens is input + output with no cache added on top. Adapters split
+on what the wire gives them — anthropic.ts and kiro-events.ts fold cache into input because their
+wire format is exclusive, while openai-responses.ts passes input_tokens through because it is
+already inclusive.
+
+oh-my-pi summing input + output + cacheRead + cacheWrite is evidence that Devin might be
+exclusive. It is not proof, and guessing wrong in the inclusive direction silently inflates
+input and bills cache at the uncached rate, because normalizeCostTokens only rejects
+read + write > input.
+
+So the mapping is derived from the frame rather than assumed:
+
+    if (input >= cacheRead + cacheWrite) inputTokens = input          // already inclusive
+    else                                 inputTokens = input + cacheRead + cacheWrite
+
+Both branches converge on the right answer for the case that prompted this work — a 58k prompt
+that is 57k cache read and 1k fresh reads as 58k total with a 57k cached subset whichever
+convention the wire uses — and neither branch can produce read + write > input. The heuristic
+is written down in the code with that reasoning, and replaced with a fixed mapping the moment a
+live ModelUsageStats frame settles the question.
+
+## 3. An HTTP status never reaches the classifier
+
+CloudChatError is thrown as "GetChatMessage failed (HTTP <status>)" with no status field, so a
+401 on a revoked import is a generic adapter failure rather than an authentication error, and
+inferHttpStatusFromAdapterMessage turns an HTTP 429 into a 502 — which means core's failover
+never rotates or backs off. Fix: carry status on the error and map 401, 403, 429 and 5xx.
+
+## 4. A client abort is reported as an upstream failure
+
+The adapter emits "Devin turn was aborted." with no status, and isClientClosedMessage does not
+recognise that wording, so a cancelled turn infers 502. Fix: emit the phrase the classifier
+already knows, with status 499.
+
+## Verification
+
+bun test tests/providers/devin-adapter.test.ts tests/providers/devin-hardening.test.ts
diff --git a/devlog/_plan/260912_devin_hardening/030_cached_token_display.md b/devlog/_plan/260912_devin_hardening/030_cached_token_display.md
new file mode 100644
index 0000000000..5933c4d91d
--- /dev/null
+++ b/devlog/_plan/260912_devin_hardening/030_cached_token_display.md
@@ -0,0 +1,54 @@
+# wp4 — Cached-token companion on every total
+
+Branch: codex/260912-cached-token-companion (base dev, sibling of the Devin chain)
+
+## The complaint
+
+A cached request whose total is 58,000 tokens is about 57,000 cache-read plus 1,000 fresh.
+The Logs table row already renders that as a total with a stacked "c 5.7만". Every other
+surface prints a bare 5.8만, which reads as a different, smaller request rather than the same
+request with its breakdown hidden. The conversation-totals banner sits directly above rows
+that do show the companion, so the mismatch is visible in one screenshot.
+
+## Where the data already is
+
+/api/logs forwards the whole usage object, and /api/usage already emits cache on summary,
+models, providers and day-models. No backend change is needed. The loss is client-side, and it
+is not only the GUI row types: Usage's UsageModel and UsageProvider, the dashboard's
+UsageSummary30d, summarizeFilteredLogs in Logs.tsx, and the CLI's CostRow each drop the fields
+before they reach a renderer.
+
+## Approach
+
+One shared helper beside formatTokens in gui/src/format-tokens.ts:
+
+    formatTokensWithCache(total, cached, locale) -> "5.8만 c5.7만"
+
+It returns the bare total when cached is undefined or zero. It does not hide the companion when
+cached equals the total: an all-cache turn with no fresh input is exactly the case worth
+showing, and suppressing it would blank the most cached request on the page. The "c" marker
+matches the existing logs.tokens.cacheRead label, which already reads "cache read (c)", so no
+new i18n key is needed.
+
+Surfaces to convert, in order of how visible the mismatch is:
+
+1. Logs conversation-totals banner — summarizeFilteredLogs also sums cacheSplit(entry).read.
+2. Usage per-model and per-provider token columns — widen the row types to keep the cache
+   fields the API already sends.
+3. Dashboard 30-day total tile — widen UsageSummary30d the same way.
+4. CLI usage report provider/model/account rows, matching the summary line that already
+   prints "cached N".
+
+The log detail panel is deliberately left alone: it already has separate cache read and cache
+write cells, so stacking the companion onto its total would duplicate them.
+
+## CI gate
+
+missing_ui_screenshot in .github/scripts/pr-quality.cjs is path-based: touching gui/src trips
+it whether or not the description says "gui". This PR therefore carries a real screenshot of
+the changed surface, produced from a build of this branch served by a throwaway proxy instance
+on its own port and its own OPENCODEX_HOME, so the operator's running service is untouched.
+
+## Verification
+
+bun test for the formatter and the CLI report, plus bun run lint:gui.
diff --git a/devlog/_plan/260912_devin_hardening/040_stacked_delivery.md b/devlog/_plan/260912_devin_hardening/040_stacked_delivery.md
new file mode 100644
index 0000000000..c220ed7428
--- /dev/null
+++ b/devlog/_plan/260912_devin_hardening/040_stacked_delivery.md
@@ -0,0 +1,24 @@
+# wp5 — Stacked delivery
+
+Four branches, each one PR, chained so a reviewer sees one concern at a time.
+
+    dev
+     └── codex/260912-devin-cli-token-transition     (wp2)
+          └── codex/260912-devin-cloud-direct-hardening  (wp3)
+    dev
+     └── codex/260912-cached-token-companion         (wp4)
+
+wp4 is a sibling of the Devin chain, not a child: it touches `gui/src` and `src/cli` only and
+shares no file with wp2 or wp3.
+
+Rules carried from the repository:
+
+- Every PR fills `.github/PULL_REQUEST_TEMPLATE.md` in full and targets its parent branch;
+  children retarget to `dev` once the parent lands.
+- Pushes use `--no-verify`; the local product suite is not run. Remote CI on the exact final
+  head is the evidence, and any skipped local check is labelled NOT RUN.
+- Merges into `dev` are serialized, parent first, and each child is rebased onto the moved
+  parent before its own merge.
+- A PR whose title or description mentions `gui` needs a screenshot, so wp4's description
+  avoids that word unless a screenshot is attached.
+
diff --git a/src/adapters/devin/cloud-direct/metadata.ts b/src/adapters/devin/cloud-direct/metadata.ts
index b371abe06a..7f7499c2bc 100644
--- a/src/adapters/devin/cloud-direct/metadata.ts
+++ b/src/adapters/devin/cloud-direct/metadata.ts
@@ -55,6 +55,33 @@ const CLOUD_CHAT_OS = 'windows';
  */
 const DEVICE_FINGERPRINT_BYTES = 366;
 
+/** Prefix every Cognition session key carries in `Metadata.api_key`. */
+const DEVIN_SESSION_TOKEN_PREFIX = 'devin-session-token$';
+
+/** A bare JWT: three base64url segments. Nothing else is reshaped. */
+const BARE_JWT_PATTERN = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/;
+
+/**
+ * Restore the `devin-session-token$` prefix on a bare JWT.
+ *
+ * Cognition reads `Metadata.api_key` as a prefixed session token. A key that
+ * arrives without the prefix — a JWT pasted into `apiKey` by hand, or one
+ * copied out of the CLI's file without its prefix — is sent verbatim and comes
+ * back as an opaque `permission_denied`, which reads as a revoked account
+ * rather than as a malformed credential.
+ *
+ * Only a bare JWT is reshaped. The other key formats this field has carried are
+ * not JWTs and must pass through untouched: a Codeium-classic bare UUID, an
+ * `sk-ws-01-…` Windsurf key, and a `cog_…` session key would all break if they
+ * were prefixed. Anything already containing `$` is left alone for the same
+ * reason.
+ */
+export function normalizeDevinSessionToken(apiKey: string): string {
+  const trimmed = apiKey.trim();
+  if (!trimmed || trimmed.includes('$')) return apiKey;
+  return BARE_JWT_PATTERN.test(trimmed) ? `${DEVIN_SESSION_TOKEN_PREFIX}${trimmed}` : apiKey;
+}
+
 export interface MetadataInput {
   /** Persistent api_key from OAuth (`devin-session-token$<JWT>`). */
   apiKey: string;
@@ -100,12 +127,14 @@ function osString(): string {
 export function buildMetadata(input: MetadataInput): Buffer {
   const version = input.windsurfVersion ?? WINDSURF_VERSION_STRING;
   const os = input.osName ?? osString();
+  // One boundary, so no caller has to remember the prefix rule.
+  const apiKey = normalizeDevinSessionToken(input.apiKey);
   if (input.cloudChatShape) {
     const clientVersion = input.windsurfVersion ?? CLOUD_CHAT_CLIENT_VERSION;
     return Buffer.concat([
       encodeString(1, CLOUD_CHAT_CLIENT_NAME),
       encodeString(2, clientVersion),
-      encodeString(3, input.apiKey),
+      encodeString(3, apiKey),
       encodeString(4, 'en'),
       encodeString(5, input.osName ?? CLOUD_CHAT_OS),
       encodeString(7, clientVersion),
@@ -117,7 +146,7 @@ export function buildMetadata(input: MetadataInput): Buffer {
   const parts: Buffer[] = [
     encodeString(1, 'windsurf'),                     // ide_name
     encodeString(2, version),                         // extension_version
-    encodeString(3, input.apiKey),                    // api_key
+    encodeString(3, apiKey),                          // api_key
     encodeString(4, 'en'),                            // locale
     encodeString(5, os),                              // os
     encodeString(7, version),                         // ide_version
diff --git a/src/lib/redact.ts b/src/lib/redact.ts
index f9e3e3ec6a..2206a9baa9 100644
--- a/src/lib/redact.ts
+++ b/src/lib/redact.ts
@@ -252,6 +252,13 @@ const SECRET_VALUE_PATTERNS: Array<[RegExp, string]> = [
   [/((?:"(?:api[_-]?key|access[_-]?token|refresh[_-]?token|id[_-]?token|client[_-]?secret|refreshToken|accessToken|clientSecret|apiKey)"\s*:\s*"))([^"]+)(")/gi, `$1${REDACTED_SECRET}$3`],
   // Raw JSON "token" field values (Copilot token exchange bodies echo the credential here).
   [/(("token"\s*:\s*"))([^"]+)(")/gi, `$1${REDACTED_SECRET}$4`],
+  // Cognition/Devin session keys, and the bare JWTs several providers hand out.
+  // A Connect EOS trailer can quote the request that carried the key, and the
+  // rules above only fire on a label — `Bearer`, `api_key=`, `"token":` — which
+  // a quoted proto field does not have. `eyJ` is the base64url of `{"`, so the
+  // JWT rule needs a real three-segment shape and does not match ordinary prose.
+  [/\bdevin-session-token\$[A-Za-z0-9._~+/=-]{8,}/g, REDACTED_SECRET],
+  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g, REDACTED_SECRET],
   [/\b(arn:aws:[A-Za-z0-9_-]+:[A-Za-z0-9-]*:\d{12}:[A-Za-z0-9_/:+=,.@-]+)\b/g, REDACTED_SECRET],
 ];
 
diff --git a/src/oauth/devin-cli.ts b/src/oauth/devin-cli.ts
index abb3cd14ab..78107d409d 100644
--- a/src/oauth/devin-cli.ts
+++ b/src/oauth/devin-cli.ts
@@ -70,10 +70,14 @@ export function devinCliCredentialsPath(
   if (override && (override.startsWith("/") || /^[A-Za-z]:[\\/]/.test(override))) return override;
   const paths = platform === "win32" ? win32 : posix;
   if (platform === "win32") {
-    const appData = env.APPDATA ?? paths.join(homedir(), "AppData", "Roaming");
+    // `??` treats an empty APPDATA as set, and join("", "devin", …) is a path
+    // relative to whatever directory the proxy was started in — so a file planted
+    // there would import as the operator's own CLI session. An empty or
+    // whitespace-only value is an absent value.
+    const appData = env.APPDATA?.trim() || paths.join(homedir(), "AppData", "Roaming");
     return paths.join(appData, "devin", "credentials.toml");
   }
-  const dataHome = env.XDG_DATA_HOME ?? paths.join(homedir(), ".local", "share");
+  const dataHome = env.XDG_DATA_HOME?.trim() || paths.join(homedir(), ".local", "share");
   return paths.join(dataHome, "devin", "credentials.toml");
 }
 
@@ -83,30 +87,60 @@ export interface DevinCliCredentialFile {
 }
 
 /**
- * Read the two keys that matter, and nothing else.
+ * Upper bound on the credential file we are willing to parse.
  *
- * The measured file is four flat `key = "value"` lines: no tables, no comments,
- * no single quotes. A line matcher is therefore enough and a TOML dependency is
- * not, and the quoted form is required rather than optional — an unquoted
- * matcher would pass its own fixtures and miss the real file.
+ * The measured file is four short lines. Reading an arbitrarily large file into
+ * a string and running two global-ish regexes over it is work we never need to
+ * do, and a file this size is not the CLI's.
+ */
+const DEVIN_CLI_CREDENTIALS_MAX_BYTES = 64 * 1024;
+
+/**
+ * Why the import has no credential, for the one error message the caller owns.
  *
- * Returns undefined rather than throwing so the caller owns the one error
- * message. Nothing here ever puts the file's contents into a thrown value.
+ * `missing` and `unreadable` used to collapse into the same `undefined`, so a
+ * permission error on an existing file was reported as "not signed in" and sent
+ * the operator to `devin auth login`, which does not fix it.
  */
-export function readDevinCliCredentialFile(deps: DevinCliLoginDeps = {}): DevinCliCredentialFile | undefined {
+export type DevinCliCredentialOutcome =
+  | { kind: "ok"; file: DevinCliCredentialFile }
+  | { kind: "missing" }
+  | { kind: "unreadable" }
+  | { kind: "incomplete" };
+
+export function readDevinCliCredentialOutcome(deps: DevinCliLoginDeps = {}): DevinCliCredentialOutcome {
   const path = devinCliCredentialsPath(deps.env, deps.platform);
   const exists = deps.exists ?? existsSync;
-  if (!exists(path)) return undefined;
+  if (!exists(path)) return { kind: "missing" };
   let raw: string;
   try {
     raw = (deps.read ?? ((p: string) => readFileSync(p, "utf8")))(path);
   } catch {
-    return undefined;
+    // Nothing from the error is repeated: it carries the path, and an EACCES
+    // message is not worth the risk of echoing anything read off disk.
+    return { kind: "unreadable" };
   }
+  if (raw.length > DEVIN_CLI_CREDENTIALS_MAX_BYTES) return { kind: "unreadable" };
   const apiKey = raw.match(/^\s*windsurf_api_key\s*=\s*"([^"]+)"/m)?.[1]?.trim();
   const apiServerUrl = raw.match(/^\s*api_server_url\s*=\s*"([^"]+)"/m)?.[1]?.trim();
-  if (!apiKey || !apiServerUrl) return undefined;
-  return { apiKey, apiServerUrl };
+  if (!apiKey || !apiServerUrl) return { kind: "incomplete" };
+  return { kind: "ok", file: { apiKey, apiServerUrl } };
+}
+
+/**
+ * Read the two keys that matter, and nothing else.
+ *
+ * The measured file is four flat `key = "value"` lines: no tables, no comments,
+ * no single quotes. A line matcher is therefore enough and a TOML dependency is
+ * not, and the quoted form is required rather than optional — an unquoted
+ * matcher would pass its own fixtures and miss the real file.
+ *
+ * Returns undefined rather than throwing so the caller owns the one error
+ * message. Nothing here ever puts the file's contents into a thrown value.
+ */
+export function readDevinCliCredentialFile(deps: DevinCliLoginDeps = {}): DevinCliCredentialFile | undefined {
+  const outcome = readDevinCliCredentialOutcome(deps);
+  return outcome.kind === "ok" ? outcome.file : undefined;
 }
 
 /** True when a signed-in CLI credential is readable. Used for status, never for auth. */
@@ -119,16 +153,29 @@ export async function loginDevinCli(
   _opts?: DevinCliLoginOpts,
   deps: DevinCliLoginDeps = {},
 ): Promise<OAuthCredentials> {
-  const file = readDevinCliCredentialFile(deps);
-  if (!file) {
-    // Deliberately names no path contents and no parsed value. A Connect error
-    // can echo a request, and redactSecretString does not recognise a bare JWT
-    // or a devin-session-token, which is why register-user.ts refuses to repeat
-    // error bodies; the same caution applies to anything thrown from here.
+  const outcome = readDevinCliCredentialOutcome(deps);
+  // Each branch deliberately names no path contents and no parsed value. A
+  // Connect error can echo a request, and redactSecretString does not recognise
+  // a bare JWT or a devin-session-token, which is why register-user.ts refuses
+  // to repeat error bodies; the same caution applies to anything thrown here.
+  if (outcome.kind === "unreadable") {
+    // The file is there and we could not read it, so `devin auth login` is the
+    // wrong instruction: it would succeed and change nothing.
+    throw new Error(
+      "Found a Devin CLI credential file but could not read it. Check its permissions and size, then try again.",
+    );
+  }
+  if (outcome.kind === "incomplete") {
+    throw new Error(
+      "The Devin CLI credential file is missing its session key or API server URL. Run `devin auth login` again to rewrite it.",
+    );
+  }
+  if (outcome.kind === "missing") {
     throw new Error(
       `No signed-in Devin CLI session found. ${DEVIN_CLI_INSTALL_HINT} Then run \`devin auth login\` and try again.`,
     );
   }
+  const file = outcome.file;
   // The host comes off disk and then receives the key, so it passes the same
   // allowlist as the RegisterUser host. An unallowlisted value falls back to the
   // default rather than becoming an exfiltration target.
diff --git a/src/server/management/oauth-account-routes.ts b/src/server/management/oauth-account-routes.ts
index 89f80e5f88..480e8c7842 100644
--- a/src/server/management/oauth-account-routes.ts
+++ b/src/server/management/oauth-account-routes.ts
@@ -78,6 +78,24 @@ import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, C
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, readManagementJsonBodyOr, rethrowManagementBodyTooLarge } from "./body";
 import { codexAccountNamespaceProviderCollisionError } from "../../codex/account-namespace-match";
+
+/**
+ * Provider ids that share the Devin cloud-direct client, and therefore share its
+ * process-memory caches.
+ *
+ * `devin` signs in through RegisterUser and `devin-cli` imports a signed-in local
+ * CLI session, but both hand the same api_key to the same client, so one cache
+ * serves both and one of them clearing it is not enough.
+ */
+function isDevinCloudDirectProvider(provider: string): boolean {
+  return provider === "devin" || provider === "devin-cli";
+}
+
+async function clearDevinCloudDirectCaches(): Promise<void> {
+  const { clearCachedUserJwt, clearCachedCatalog } = await import("../../adapters/devin/cloud-direct");
+  clearCachedUserJwt();
+  clearCachedCatalog();
+}
 import { ACCOUNT_IMPORT_DEADLINE_MS, ACCOUNT_IMPORT_MAX_REQUEST_BYTES } from "../../oauth/account-import";
 import { readBoundedJsonRequestBody } from "../request-decompress";
 
@@ -255,14 +273,12 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const { clearProviderQuotaCache, clearAccountQuotaCache } = await import("../../providers/quota");
     clearProviderQuotaCache();
     clearAccountQuotaCache(provider);
-    if (provider === "devin") {
-      // The cached user_jwt's payload contains the api_key, and the catalog is
-      // keyed by that key. Without this they outlive the credential in process
-      // memory until the JWT's own ~24 minute expiry.
-      const { clearCachedUserJwt, clearCachedCatalog } = await import("../../adapters/devin/cloud-direct");
-      clearCachedUserJwt();
-      clearCachedCatalog();
-    }
+    // The cached user_jwt's payload contains the api_key, and the catalog is
+    // keyed by that key. Without this they outlive the credential in process
+    // memory until the JWT's own ~24 minute expiry. `devin` and `devin-cli`
+    // share one cache, so gating on `devin` alone left a CLI-imported key's JWT
+    // resident after its own logout.
+    if (isDevinCloudDirectProvider(provider)) await clearDevinCloudDirectCaches();
     return jsonResponse({ success: true });
   }
 
@@ -685,6 +701,10 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const { clearProviderQuotaCache, clearAccountQuotaCache } = await import("../../providers/quota");
     clearProviderQuotaCache();
     clearAccountQuotaCache(provider);
+    // Same reasoning as logout. Removing the last account for a provider used to
+    // leave the JWT and catalog in memory, because only the logout route cleared
+    // them.
+    if (isDevinCloudDirectProvider(provider)) await clearDevinCloudDirectCaches();
     return jsonResponse({ ok: true });
   }
 
diff --git a/tests/lib/redact.test.ts b/tests/lib/redact.test.ts
index 26a4912a27..f15e4aa30d 100644
--- a/tests/lib/redact.test.ts
+++ b/tests/lib/redact.test.ts
@@ -550,3 +550,26 @@ test("redact-folding folds colon confusables with aligned offsets and stays a ze
   const source = readFileSync(repoPath("src/lib/redact-folding.ts"), "utf8");
   expect(source).not.toMatch(/^import /m);
 });
+
+describe("bare credential shapes with no label to key off", () => {
+  test("a Devin session token is masked wherever it appears", () => {
+    // A Connect EOS trailer can quote the request that carried the key, and the
+    // labelled rules never fire on a quoted proto field.
+    const token = "devin-session-token$eyJhbGciOiJIUzI1NiJ9.eyJhIjoxfQ.c2ln";
+    const masked = redactSecretString(`permission_denied: api_key ${token} was rejected`);
+    expect(masked).not.toContain("devin-session-token$eyJ");
+    expect(masked).not.toContain("eyJhbGciOiJIUzI1NiJ9");
+  });
+
+  test("a bare JWT is masked, and ordinary prose is not", () => {
+    const masked = redactSecretString("token eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyIn0.c2lnbmF0dXJl here");
+    expect(masked).not.toContain("eyJhbGciOiJIUzI1NiJ9");
+    for (const benign of [
+      "version 1.2.3 shipped",
+      "see src/lib/redact.ts for the rules",
+      "a.b.c",
+    ]) {
+      expect(redactSecretString(benign)).toBe(benign);
+    }
+  });
+});
diff --git a/tests/providers/devin-cli-login.test.ts b/tests/providers/devin-cli-login.test.ts
index ba82c033f1..766e28eca2 100644
--- a/tests/providers/devin-cli-login.test.ts
+++ b/tests/providers/devin-cli-login.test.ts
@@ -5,6 +5,7 @@ import {
   devinCliSignedIn,
   loginDevinCli,
   readDevinCliCredentialFile,
+  readDevinCliCredentialOutcome,
   refreshDevinCliToken,
 } from "../../src/oauth/devin-cli";
 import { resolveDevinApiServer } from "../../src/oauth/devin";
@@ -135,3 +136,74 @@ describe("devin tenant selection is provider-scoped", () => {
   });
 });
 
+
+describe("devin-cli credential path and read bounds", () => {
+  const okFile = [
+    'windsurf_api_key = "devin-session-token$eyJhbGciOiJIUzI1NiJ9.eyJhIjoxfQ.sig"',
+    'api_server_url = "https://server.codeium.com"',
+    "",
+  ].join("\n");
+
+  test("an empty XDG_DATA_HOME or APPDATA does not become a cwd-relative path", () => {
+    // `??` treated "" as set, so join("", "devin", …) resolved against whatever
+    // directory the proxy was started in, and a planted file there would import
+    // as the operator's own CLI session.
+    // The fallback reads the real home directory rather than env.HOME, so the
+    // assertion is on shape: absolute, and under the home data dir.
+    for (const empty of ["", "   "]) {
+      const resolved = devinCliCredentialsPath({ HOME: "/home/u", XDG_DATA_HOME: empty }, "linux");
+      expect(resolved.startsWith("/")).toBe(true);
+      expect(resolved.endsWith("/.local/share/devin/credentials.toml")).toBe(true);
+    }
+    const win = devinCliCredentialsPath({ APPDATA: "" }, "win32");
+    expect(win.endsWith("AppData\\Roaming\\devin\\credentials.toml")).toBe(true);
+    expect(win.startsWith("devin")).toBe(false);
+  });
+
+  test("a present-but-unreadable file is not reported as a missing sign-in", async () => {
+    const deps = {
+      env: { HOME: "/home/u", XDG_DATA_HOME: "/home/u/.local/share" },
+      platform: "linux" as NodeJS.Platform,
+      exists: () => true,
+      read: () => { throw new Error("EACCES: permission denied"); },
+    };
+    expect(readDevinCliCredentialOutcome(deps)).toEqual({ kind: "unreadable" });
+    // "run devin auth login" would succeed and change nothing, so the two
+    // outcomes must not share one message.
+    await expect(loginDevinCli({} as OAuthController, undefined, deps)).rejects.toThrow(/could not read it/);
+    await expect(loginDevinCli({} as OAuthController, undefined, { ...deps, exists: () => false }))
+      .rejects.toThrow(/No signed-in Devin CLI session/);
+  });
+
+  test("a file past the parse bound is refused rather than scanned", () => {
+    const deps = {
+      env: { HOME: "/home/u", XDG_DATA_HOME: "/home/u/.local/share" },
+      platform: "linux" as NodeJS.Platform,
+      exists: () => true,
+      read: () => okFile + "#".repeat(64 * 1024),
+    };
+    expect(readDevinCliCredentialOutcome(deps).kind).toBe("unreadable");
+    expect(readDevinCliCredentialFile(deps)).toBeUndefined();
+  });
+
+  test("a file with only one of the two keys names the incomplete case", () => {
+    const deps = {
+      env: { HOME: "/home/u", XDG_DATA_HOME: "/home/u/.local/share" },
+      platform: "linux" as NodeJS.Platform,
+      exists: () => true,
+      read: () => 'api_server_url = "https://server.codeium.com"\n',
+    };
+    expect(readDevinCliCredentialOutcome(deps).kind).toBe("incomplete");
+  });
+
+  test("no thrown message repeats the key", async () => {
+    const deps = {
+      env: { HOME: "/home/u", XDG_DATA_HOME: "/home/u/.local/share" },
+      platform: "linux" as NodeJS.Platform,
+      exists: () => true,
+      read: () => { throw new Error("EACCES"); },
+    };
+    const err = await loginDevinCli({} as OAuthController, undefined, deps).catch((e: unknown) => e);
+    expect(String(err)).not.toContain("devin-session-token");
+  });
+});
diff --git a/tests/providers/devin-hardening.test.ts b/tests/providers/devin-hardening.test.ts
index 07a5302ce7..c793162ce3 100644
--- a/tests/providers/devin-hardening.test.ts
+++ b/tests/providers/devin-hardening.test.ts
@@ -6,6 +6,14 @@ import { registerUser } from "../../src/oauth/devin/register-user";
 import { anySignal } from "../../src/lib/abort";
 import { buildGetChatMessageRequestForTests } from "../../src/adapters/devin/cloud-direct/chat";
 import { iterFields } from "../../src/adapters/devin/cloud-direct/wire";
+import { buildMetadata, normalizeDevinSessionToken } from "../../src/adapters/devin/cloud-direct/metadata";
+
+/** Tag -> field for one encoded proto message. */
+function iterFieldMap(buf: Buffer): Record<number, { wire: number; value: unknown }> {
+  const out: Record<number, { wire: number; value: unknown }> = {};
+  for (const f of iterFields(buf)) out[f.num] = { wire: f.wire, value: f.value };
+  return out;
+}
 
 const FAKE_TOKEN = "eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyLTEifQ.c2lnbmF0dXJl";
 
@@ -247,3 +255,28 @@ describe("devin cloud request shape", () => {
     expect((metadata[31]?.value as Buffer).length).toBe(732);
   });
 });
+
+describe("devin session-token normalization", () => {
+  test("a bare JWT regains the prefix the service reads", () => {
+    const jwt = "eyJhbGciOiJIUzI1NiJ9.eyJhIjoxfQ.sig";
+    expect(normalizeDevinSessionToken(jwt)).toBe("devin-session-token$" + jwt);
+    // Without this, the key goes out verbatim and Cognition answers with an
+    // opaque permission_denied, which reads as a revoked account.
+    const metadata = iterFieldMap(buildMetadata({
+      apiKey: jwt, requestId: 1, sessionId: "s", triggerId: "t", cloudChatShape: true,
+    }));
+    expect((metadata[3]?.value as Buffer).toString("utf8")).toBe("devin-session-token$" + jwt);
+  });
+
+  test("every other key format this field has carried passes through untouched", () => {
+    for (const key of [
+      "devin-session-token$eyJhbGciOiJIUzI1NiJ9.eyJhIjoxfQ.sig",
+      "3f2504e0-4f89-11d3-9a0c-0305e82c3301",
+      "sk-ws-01-abcdef",
+      "cog_abcdef",
+      "",
+    ]) {
+      expect(normalizeDevinSessionToken(key)).toBe(key);
+    }
+  });
+});

From 7b3c4e9800233d120be43e122c94e9cbe5f38414 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 13 Sep 2026 00:15:46 +0900
Subject: [PATCH 15/17] feat(usage): show the cached subset beside every token
 total (#4421)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A cached request's total is mostly cache. A 58,000-token prompt that is
57,000 cache read and 1,000 fresh was printed as a bare 58,000 on every
surface except the logs table row, so it read as a different, smaller
request than the row directly beside it.

formatTokensWithCache renders the total with its cached companion —
5.8만 c5.7만, 58K c57K — reusing the marker the logs.tokens.cacheRead
label already documents as "cache read (c)", so no new i18n key is needed.
A provider that reports no cache is untouched, and a turn served entirely
from cache still shows the marker, since that is the row worth seeing.

No backend change: /api/logs forwards the whole usage object and /api/usage
already emits cache on summary, models and providers. The loss was purely
client-side, in the row types and the aggregators, so the fix widens
UsageModel, UsageProvider, UsageSummary30d, the CLI CostRow, and
summarizeFilteredLogs to keep the fields that were already arriving.

The log detail panel is deliberately left alone: it already has separate
cache read and cache write cells, and stacking the companion onto its
total would duplicate them.
---
 .../cached-token-companion.jpg                | Bin 0 -> 18950 bytes
 gui/src/format-tokens.ts                      |  21 ++++++++++
 gui/src/pages/Logs.tsx                        |  15 +++++++-
 gui/src/pages/Usage.tsx                       |  12 ++++--
 gui/src/pages/dashboard-overview-head.tsx     |  10 ++++-
 gui/src/pages/dashboard-shared.ts             |  12 +++++-
 scripts/test-layout/layout.json               |   1 +
 src/cli/usage-report.ts                       |  36 ++++++++++++++++--
 tests/cli/cli-usage-report.test.ts            |  25 ++++++++++++
 tests/fixtures/test-layout-expected.json      |   1 +
 tests/gui/gui-format-tokens-cache.test.ts     |  29 ++++++++++++++
 11 files changed, 152 insertions(+), 10 deletions(-)
 create mode 100644 devlog/_plan/260912_devin_hardening/cached-token-companion.jpg
 create mode 100644 tests/gui/gui-format-tokens-cache.test.ts

diff --git a/devlog/_plan/260912_devin_hardening/cached-token-companion.jpg b/devlog/_plan/260912_devin_hardening/cached-token-companion.jpg
new file mode 100644
index 0000000000000000000000000000000000000000..2110f1f8ed0d5a4c32265e344a509836c151305f
GIT binary patch
literal 18950
zcmeIa2S8NIvM9O$5k&z}lAz!g$w`o$)eShqW{@Fgl{iDrIT%1CDlni#aTo>|g5(?|
z3J6FN8G>Xa3{i4=Yt-%D=bp3gJ@>tP&wKCx*Vxs)s;j%Js=L<e?&|UA)6p1k2C58E
z21rN%fCT&lj)s7n!0}_`$H|W!KTdv}g5vlI$}^OdCr?t+QPZ40!$`-(#7M`$z<iN|
zjhTi00t3S({!8qfTs*uy=h+0V3UFWL;O5~bHbO!{K|y(f@*E}QIc{bKX72xVII06^
zPmnw#Yak=J43N^2kkOJHH3AnvR(}NGM<5|31No&m0hX$q0Z73|3K9xZQi>BKq!gf3
zq-3<m&i+DvPFMqe_j&4Zy35z^IYo)wr`Kd;zow-f-A!>rC+2nj+a881&SEZZ4+_Uu
zz=oK<_wjod#FW?#Si(UI>WYMv{1_Rit?z+^mXz%5xnDF==`IVykBMA&I>G~|!D3Qc
zGFm_ZI6SLJb&2J4AixeZ<x&QYQI@4REh1^_q1pLoA4V7r_P`ip7&0Z^LJv>l#>wUg
ze(`UvKFX79?Y!-nh~^|T?F$So9>Cnh-Jm|al7l6MYDzbS_VUCq0abde0F8S?{f8F2
zFjhuJ<GU*xS<UpkB~gzI`$xXiI?7%;SoDh=>~6Ztt()^Cn6nBg_E0ZGB$H1$F|%m$
zB?pI;!GckBR~%uvu*|{ANs?Jlf5H-XTl>mF3tu&AF{g83lWeVS*GJb<h5XUmdkEdn
z@WxF2>EcAYfP~rg!WmTm;T^z7+=M~$y#YoFD%>_Q5j~c-ZoR7|&LN#}qnKRBIgF<n
zGBjbg9~FXHq<Bm5*^n|ZAx8M@NLC>hp_JZdMzL;cIB8E_zsRg@^Wo7#TW=0iRi+^y
zuCl<-RN)O<3dKNhd-`JHys6`Y#FZ!q_nD{}FL8Tn$w95)Ee<6{?&g6G^P!#19pi;M
z8YTdc?-zIu)kD&ouuo>f(zd+0tefX@+;l4rUXEf52d_*rw`C8nDGPTW0oLgCz56?3
ze#HgW&|)Uue&;?Mlaz%iC6aJByyTU?CoRgMOgGKJ)0ZSZUrd+XQ+uU&(ox=8ezAl@
z!T=@h8JblVbOM44(6uQqUMndrpBZ8iw%uj2oaWL=w-DXtj4`g(W8-IoC3ie}^A*>A
zW(yXR)rVwsDvGg1ZS?1=Kr2~AEx5HBF_JP}W7}HS%1pK<1LFKI`3CxkM;zDVX%?|}
zLJ>F^q6el9Kkk{dg#A9*{%2Ae3x&nWO;O8~FOi?R&y$|OfQ@LK_(hQ$Oiw-oP6yth
zQ@s7#2>`h9;0bVP;=CYL#z{wjbOlfZriwgNUPnmKDkr8=hAYDeqDdpYJ6j=Acscpk
z-E$ivxn))Ue2nxL)DT)wm;t6~)k@-N_R8L49sBU!chi`D!V%!Es)Fq^kduGqEOS>_
z%<;t&-G(j>J^z>bG6;v4LnMY&kDKARka`t*Wx+KxZ`6bMY0t{MPX`pMpREGM7KQc?
z*^hub^1gn!Ayu~E<|<dr(*_7MX8J@a0~+O9qk1#4i1h<O!P-UxSG+1j3y(4Sg^Mmb
z&&S%&VX~(42zdL+bZ1}Xu<=lCae4n@&=HW*7_dk&yE>%87!fWOn!_8CG^`0h65I(*
zm3*bR0@=s&M?j>H%n?9wH(+*^ZI4aJZgSIJto!g{ex~hkTxaT&OkFvG!^e@FJnB2X
zc>4L<2`C<mXq~Z?gU(gFUYS-Gb4iLA{o&)3@wp9-$=-Pi2fxPI_c#bLDfVgcAYzT<
zf`zx_6CJEZX8mg%D-<!hIp$pD?WY8i9-o`A(X<hOAQ+D&R6x>G&=w8%7RJ$HH_#7I
z346G~P48--#AVhL4bQK;_XF)$e{^tbf=?NpyauzUPMTU?DYmisl;1QEg39WefQXNb
zMl6`dW=w-MLR+wX)On1?y{;qrWu+b-xSnAMzZyb0#%M?@X?*DME_)KlgAi-VZ8^zm
z^wXv$<)U6FOeajs{xbt%Q)-||Cl88}E_4o(nO2|n5!z=*{UDdoXx2qXduU*e^=U$I
z^1NM7GbdLyu~BXq?wPLKQV$0c?-IiB`Y1SQK$gicwra=^k9hlHCK>Rx;!B;Jc|Rn2
zh6IZlBh@p`AOBxR5w$~Xi|P1Jg}H8f`>8a5BXaexa;ny#V&7e~0~z{vbMR@f<qOw`
z_`Us<^}s5P#43M}Tmz@RIgyg&^A&GD)hO9&#r22XV4{4>b@%=(1=@q!gcx6Wz5O!M
z5SOVf>AXSqo<<c*ZIT8)XRtbYd)%I$mjL5Ap{sH-8O|FlU_5Se$Gh|g{&cbWSCvI%
zBea#HuKNr?2OOgZ?kj?pO^n1qrwD>G!1cO7J$&F*@=L%8CL@jG*>Uvl#?rbOzWOI{
zSm*|`YaSe6qk(P^BS4Pssa67`B8m0aJWvsNw*g-{KG2By`T&MV=ms(VEfE|nYv(2<
zLa=bH4TuF{6S}9WAdmxu`CuFTuTB!-e<z{9-||f4ml*#LjH02ZS_O=XBrBj`VEisv
z1yOpzB)&dGPxUPTe9~|uW=f6u`izN10t3(uM(`o<6o^*>A1;xO{F$gc4!R)%e6;AP
zRtDp5fno`BCTNL&lS`R1!E}Ai(*&qycXc!VZEjf}H7}6@-M9*ju7j1mz7a07L3uMh
zvPwVAkUVyNzIx0;QSlXUDdQL=IHIIr{1#pVCje6Ly}cg#fJOUQSvl#%6mW{IuV$)D
zeL~T0)gr_>3L-ul`>U_s<ys9>^E-%p2rP3#RzC-`fR$G?T%%(J=L?k<oDIbrC)~7>
z6}47IbPBXz+Y6YPZ3#!_Ct5H^!$YeKqAPs6t6)O3Ax@szO2|%GiD>6i{Fu}4T>PHO
z69f_-$2PfbX`67lPvvk~uJa+{(w8IOZ7ZW77z-)GC5pKP+uyDjGZpLbrdwv^oP&y#
zgzrzqvC!HYC*$CcvRX%_u^QJ`L!2usx}{{?6|V7gLVIH3ml_fi%@{c+Sx;7<VRO#y
zs8@c(!BUw~t}eZ;i9K)1H|ajOR)XTbjhD<4?N5ber_$|k_DDjVqhWAo#FYe(0;7{s
zP?wllE*{88$<okI_5IE`oBG``bU4mLB-o153;j}+*Tcv;ecPnvJ#VxTi|HK&<HAkx
zj%3ap=CAWSD)h`YqHA-QiRj|xoSd9;8PheP&{DFT3p$rW;?X8KVsac&c9wgIip0j*
z(t_W=RUJH7bKF8*T*#~%t1t>!^S8~9LHiaU=R3PX$Tm{mZu(?C)_A;$LTG+;P~mP5
zQ7iVa%(Ih1`sP_XO8U}eWD7vG%_M{tcpzm(ISvV>?{~TwpCY3?LptDyUj5H?1E-v?
zJ!u?h6kVmy(zf|^mW$7e?Ah<4{YXi6e}lEWdb7==@hBR{>lB^Hg+^FzxR3eU_GF6o
zYDOVOM7K#c#79n3@w)o8Ik^dO!1)wx{PTu)xS;(Dx`>ZBINIo1Yo(Xe{S9|kGMWf&
zzlpTeD8~Z<|2UsjzgX<hpnuocs#X>huFC&9hf5#;7nU8b16z)$(s?}Dr7e&ej%H-m
zd#@x}Z4j=1<!h-tMCcQZXcQbFleWEn=}+8x_$vA;nx7!0B!8<2D3;#>UKts^B5$fA
zadIRHeRkgwBqffY#;gd57RfV8Mbe<ic~fU$;-tT5dUly>K#0?nK@Zo;hY3g^B|fry
z$(MU6=#)^MW-Kb+G&Z1Lzy>!e$1GfL@PUiY%ypuYGuwEF9sFlj{F~cq+UoBi`*M_X
zyz|pujr(?LWb~*9EvxYv*M?3}OnF2v#67P{F{(-_s@wa8(y_6NDgRm$zbKYlISF;%
zr)0z7;xgOQK^Lb0v$q6_LOnZ_Nx0AiuT)GPyqfa)BSLH^mC_7s>0?c3#4CRrB3~@6
z8||&Tgy=;-et#AU&Cz*_My*F4D;RGDdcTjqjwJi|y1ReK-xSeyqNKxw1jTT{lMKW&
zl?BBv&g5Y?kt6AW`@w5|&TA4NXVFUps)y>Qf(DDHpAPpl^*WE<`-MBZP1ue*qug*}
z(lVuWZA0LBP+Wmzl^U-;ZX6r0*9y<b)DDfghlbfhEGs=igBBBN0{zW?a`x<a>F*-H
z1pZ+7-$BoRSI|rOO}4wddkR##UQsy^%S`uV1N%AIs(_KnjZ5;Ze{kGzZ`=$flKC`i
zou^eyjU&!Ei>oCf)39%5lS8szGg(ldPNJ5IuPTKqDX(QRBE`?OPhR|I?Pb+LLSG+J
zw?l&ms&N}Br8O)XCzH!C<~dt1u8z37lAAp>tLY)0IbBp#5$fwXM_fzV|Ex{;FsLP5
zWDFI}m$VVB&54RCZJz4&^7eNxsR&w}whD`76?;uM+>40sysBHc8%;Lh@N+WV)E%5x
zCqJ!r!NkBm!sjED8ea9a(3|h(w4V=KBAFpLrte18b4|dH0dcZ~Pwh@mz5A~~@0q-_
z{X#It$?~tb<$E;r$CyF49>uW0-6yl4Bi*YU=WoES!9-vkVwNu$|1)DKzg%o6Y`ay6
z)T|qL+uJzKt}9^FxmKw*f?0#iy{CElzb=J3tgXI*rO5j3`~dbbR?1hK7ow!(<XtV)
zb_878NVqxpUe=0m<?0K{V)lpi8jU@f(83&M{UpAovM*m_Mn1P1(KP*3zx+(opc{`}
z6)PKJ3{jyM0<GM7EXLGra}Bowk-MBQxyJ^JWi!)$+ta8*9)(iU`RH~bCf38IG`3Y5
z;k!gJMYNS~R-AnBuyC?iyqKRoG4*_AtA##>Ki^p+WTzG1Ua2xzzi6#$W{2n>EQ@!$
zy6KAS$4a)gi)ubfT61(zwe$c#3qn8jav)K}a{P7Xqb;fwcsSw?Hl*=(yW~>eg+kdv
zdk8lsXX9gwUrN5U_Mi+Iqd<b;5rAu)xLS}YApt8|yXlry9P1^9<$6cc`iG34i?mAo
zWW_IzWmISzL#!YWK5otGnBo%K&DwX{ihr2muKK-$#J7a4kgbs%6{{uZX>9?o(S5;z
zQ{E{VhY{`y`<mdk2Ym$GGh~mbK42E23b;m`n#x2o2>9*K6n76UECy_2PaOf^j%gxn
zH>c*1ZzuVux$Ihfb;&;hCK81X*!F0?%$gkmO_HX&3Y!;hZy5UR>#oZYr#VpouCHBx
zDwZ^>9o%ef7+d)GxM&*!OS}+cVr*a}`fTFSep2PZs%huXH%xM^3wD1yk_h6xS=D|v
zmp2Srt~^%?EmSlu#uDqcMwVc2WEkKKP<S-bu5z0L01pW{327ksRd@jab--}|xC)4n
z+^PcrZc-zX>9R8N+owVUPa6du3xMxEXxR`dr|(|9lNZXk7$`oHJNjVxMXkBeAW%7=
zn_*XJTur|Bi~l?77q&`9f|pU==NxfRsAJR)#L-HEbI7i;=JLU_T62;Tg8N9&NREg7
z4dUZ5a$*Z4Bo2e8HWd{OH$mhXhCdZhhg9pewra;mhlKYfEtUzDguV?W60v;#sNpo)
z*R~k{esM9onnfv?vs$XzF-PZGNRfGZuc-jF$70alB{_QGPw_DbILbSr0@)oBts3gF
zH@_jJm8X-dM$qrN+<u|Qfp@B$=^GOxlTL74bu4FPR?ccg#IEDOmbqt@YS`;l`b6_}
zv82HohkD7+1)%K9vi7|8_MY);E)n|RsxywOgVp(4L0~Dd(@O$GJ)Ah@|IW04l=Q!;
zp!}Q0ZdUV~aE5ciVlNl*)Ch;+)i=L$8072_>OC(+R4R+zNXg(`sT&$GS0=eD)05)O
zzX{t@!&$>FRHcK{6*|4{TpIoSuSVb>3=K)3jQl0}E2nds-T|dNQNxsis-gGo1#bkF
zl^p};3+codP*w(z2nuT45(JFE<Ha!=VSox?s8bA4rd0(O95W!e|5&9da67*tP<M`N
zF<2UdjCpeo8<t3CUTSBMW*F5$;Unfbl!Vu*d1&LqV`z2beEv2i%1S7hvdGM{^a=*F
z`-XrKkJ7f-LA-OLPXnH*<52tJ%&vZRS{iEkEre@JSF*2Vl6P$U5iTT8mY>zS8>KwX
zn49UiQ_D|-eK4pc_nB?E(-B2!Z$k?$;)05_tzF0XcB-o}m*g2<8&9qh?`^s3h;l5m
zwdagrC@JRd#c|hr8)_vb$FnMe7W1b-@d=Y3ds!557uo6A+8d-c6!f|;4HaE`QTN^U
zY`&fBJq$F_MzT5CC|4NrWhu9(veZ$|t>n01kT&y6k^RxEw$}7s2yPU7ql-E=FJ_hL
z&A9PEEW?cM9dgg8H6H=4FIx$xHAnHe+S*N>S3^R)+zdGEsNM427I?CXFT@NR<*m2H
zo1DAjGjBUA@2e!OmlcJ395$lFtE1KuT}xB_a;$NDOY}`|hu?<WbWX!WjNK6c`C@2x
z(X&)vhBF=|S<Hu%xH8a4Sog4st@cJuGiqZ|Vsx)xM^(B*tcz`_75^mc_pE$gp(nq%
zf^`;CzwvG4It~Wq4RgqW7|W#97?>)#Ot*4yzFx{h7w39AvZ$~WVx<=ME!j`;K5v&$
zPJ1<#=OZJh-6Pv$4|k5XD|P?;9y~@PhO!hxhdYjCl6R&bf9}N@BzwQ`?t!Dk0)k4S
z4pa>d<_yETqKZ6>)J;C%^#~ZrF6&8Q$;>7Lkvttu8-hE<pV#gb{hOvF!T1D^llPlp
z#nPTnvyfU*cH)a=`;oPU)iH0iKS}cY3(>>r`7-+3&tJh%7-%KxM0AKTdi2{^5AMiP
zOVAgt3OC*n7JKvQ$zgnv<v7Qtjb?U9?gx|@%yam+%&f}&s4V=b$xaS<UUpS(&&6uY
z@rAV8)nbksHzN+UK5Y>^t(_%AfF(d^kJZ3XST0(f?MY*OIBzlLMxt}M_{8g}k+Li4
zHM1!fi-aX-l6jGK;!CMam9+)eR9QmMk8nYlr#Yv^biHHH;%JEx$2)#`NOAg$DZ12~
z=Ce=GI`mwaTm4>l#S2H7uk@&wWUfdQitBVVE$-7p-!%0$PVhm)*lR<z6YmTaw62W8
z619g8)Ss{M670}ARSSJB6Bq;6q?2kNqodRN6Ip8K5S6*ii9BY)qR6{hntAYR;BjGS
z$3a4k!{gYB`(HPgC`f|pKV;s|;c0WbV8JLRnnP)q-PVeSM^zW+ud2hYv6wPVtey=^
zbg;Q0d;}E8*7-*c(wIBd^!c>E)lP*<`j#i@Y}juW$C-Ui>E`@&xOabD=&J(BqvnY>
z&M|L1<NG)`Ea%jkYALYWOCOH_x|V?V>IV?#@jMuzW<)P#vZVi$WYWtbo3Yh%Y4hE&
z`jVCDUUKzVEp^$2kC{?1j6qal(r{veT{Lm|##huST`fPZnZ-WL>-OvV&&2`d*S#QE
zMx<kA|GAEzOAs3MGOhV1Ta-x}vO~WwKo!3cCh~QoPI7Q2ZG7k?e$6e_T1VANhfe@x
zMP)BVx1Whz;#cIpL>d@K`Wg^D9r)v)vLZN<&yedV8Xi+L49pX_e~XS0Ag=?6pV0f@
zyKl_hSFiUu8v`<t1Mc+bT+GyB)WoNAu$wRye9mI0d<4(!jFr}<S?#WX3(v!@O!8Ik
z$0J7t-3Jfb%<}cZE^zQ7nO-)ZtcN;7^$V(ShN|qPgbtFO11Tygwi_jlcv0Lvp1mYQ
zJN4Q}*NK_TRsl_$UkBbVlx%VsM?b35&eM>7kpYFLqmnq23QD_zb{xs35$_Q1_OwgL
zp(dRg_<{tV{v^$i(Du_y=P|36re|$#6*m}u@l_N|3{HFkR5&v`Um~3YYXqLc{(`*>
z{24t07XGr-VEbOp`-K}y6RW>3cIA*R$NlThl?30wRboF|sumOM2H~9OYMg-<okP6_
zLT0nCZ&MASKW?Rdj^e^#s^>nz2Ex_ySmyrv*D28{@SWysA$<-fZNtx8ofco5TxwuA
zZWDQtCYikVS?_az5!BqTfH5fk84_2JUhzLftJL1J-6qHyeNjD=0fA@2B_76lFqK>M
z20xwe`in+yez6NrxtJo$i+vJtnf{A%LHxsz{$d+B&vc51|C#=&G=taD?!@cI>qZxt
zI&y*<jVvXo7jB4Cd0$0A`htw+MUn)Ds>~<8R`#l5*MHj_KZru9B?L9Ao)d#*g`zS>
zd~YXCGRf>aALgVN6(W!n(?lKl`IYC77g}p%p1zq`l@Ot?!jE3LVSuX?OYSn^-X0?=
zhs|{G2(aA57Ezb3RLO5>l(<j5Mr}LoU0V!LKI{!}dc5=D2!LBk&5v}aPkh=BCbH%(
zV{YasSy5)IeQ^Y-&i@+Uoha8?tCDHV(WN&I4nBKr`M{SA)>%_@A2l;L^fG%%{*f9>
zZo6`de_5=FGSE!xi7&i!HxQT~eLdx?s8m)CkbVkM<Ojfm3Pl0pl7jIP>9A4YDJN$-
z(A9G9!7=hW@a%3KATCsC@Ba$g(Mx`l4C<~>e)Dk-?vk{mUQ<ps21WU$(alKOV!md_
z2dVVRTIM;&XD|{{64p(|rE9v9-J79EjfU}zo<?QihO!Dfc(B7`ajj{aqC#lv=zzQ;
zS$AmjgfOb~Q%HoHbF-ihq>_(sD70W=Lv9&woX2z5!tkO_WrK1Wk3$a*rKP62!PTTN
zG;PCniDdauDEyFdU%`jXy~NOdGC|OG&}B&62#?>a!GawBDNuA{N`$pCG%=8R$`~U=
z8*dM|#n4U(c)1?Py1S=KZ%|BG5Tk8yZB!Y8oVLc*1Yo=qk_Q`$)!^a0SJV1ZnGtva
zRk8k|oiyJM6n)9VO{!F~qGnJg1fR5UXuHGH{m)VoTczyNf7|Of1}F+G?D%1AO+KAe
zJ=)G~jG4;x^znr~kX&X~NNXDmHekQYCv@xwuQc{Oc+VvC1yLthsGhe^mQTeQto51~
zymra+@0w<Vr;oOD;xd!N9Bz2p<~Q_)X-i>Wa%T)mcx34=Sy7ebzd(9IT`i!ZEB$Db
zlNuo%l9f%Z7%zk6P+#?UV8hHQlAhUVxEswR-iP2sjpS}PJf8+=u=(zry`Q48HcbRQ
z{Ro8_X?-~j%8|GupsPCl2%yj0zIi~?{@|Xl`&VRnf!vE~Y*^C-@}98d)4m*ynV9LO
z!pLf!Lo>+-r7MJG?b;VD-<|?xeEJ<`go%jGOVpzqhC5+I#I+}6rNnZnzD((e^=R97
z06^wEQ5QFFej@eEtJ{j?$AEtW;8#IU0k;S+p{R&+as~vz8o)(*HF*yI=~0#FHD|z$
zm`FUI+D{C;=m93-Q(g*Omne+Egx!l(z4aZ*0GPb{{|j*!D6&fns2J{x*T94rT>w`Q
z`;J)ho}^b6)QhOswHJ!69jw1uMRHBmk$FwF?wm)rCe~fNrV<TiUH}fFULrG*oGv84
zV@M1^YRgE@JICx-r`kQYq);T4EoD_cFSwbjd_r5wpB=AZog7~>Pt_e?l4qSFVOU)f
zVx0mETgtY5UY?-xm1}7j4m`E8#fxx+9lQ?|cuPtC^VI`<dlMZ4tj~}@9N&?HFDVAl
zMPL~EjN}$L_TU|f+ux0axnj=b^#aEG{xc*9LvvB{$FJi+C|IEjI^=Re2ok(9|NkTz
zaJn7i9VY_Hr)c;?<TDIEv~Y|YlpFINl>bav{{WQHnEUiY-S4iU+n33}I^WAc@>97n
zXB10~xh=uc6Q^E+t|QP*bXx?3sct=iBp^ZqjJID2f?gufjdUXD#<w~EBiINUjH$PO
z=FT?eXM-$-=EfYqA?DT-1Uj9-BX5#SG13R8?q3%aBtKTJm~qC4@}!d^H%C)l+MTOF
z93$xiBM_6(M_%`a><Pe4999y=jRs4z`5V`QDd@Q&#t?Y4n#-6CMS*y%IL5$JE+wo{
zD~$jb&4AjoxyC-;%(FmFy1RF5T8a%650<##;5ocLBIqC`xG?nO>^O@xVUK-$k1F5h
zCV~(q|6y>*ls2^S9*<_jq_E!Un<4!(Zf2Cvo$R1O`Z6T@?ezJZ$!9Urp4Ca=sqokK
zw744@&Z^<j217GuG=)xOA@nxg4caJXtt785!4OKQpzicb%$7olPNpsi!M_1rWSzw#
zL&k4M4lkiDIr|6;k3p3dBirU-()u|xGI@mvTjnCJ;QFOEHC?*lzN};yva;+Z&90zS
zyL95?y21kwc~|;BGD|+bk=4+quWb~`=bKkQn^n_<*AhlK7GGsb@kGaY!9<4>?Q`?&
z5yOX(p?FWL#b!<%-qULlS$Q^?hNckZI(yp4=$hOBU0=*>GCtF3hfNnR-H(ab?4k(7
z$B6rXz?oWgQl|^t9ZqGY5lh3@(!XMBu_|13U4b`s(ZD6GKW=%!psiZPYc-p)*slRd
ztH%M0^B8G5>*j3n_a6Nj6Vp$_y(*~6X95D^-XA)CH^qMvrUCG0uZY*SG)@JQALFKd
z5E#_-mNersIPywm;BuZcs2t3c19WL1hQtvtG6ERE6?~f_IRkL=?!CZEN<TU}ar@Yt
ze8sa(08q{Z(p^v_QT$fIiYao+)Hf3rKLXY*4qwZtu&_)w-_sr$$!a&%48dX>j{tL{
z=S#;Iz}@Q;?t8-YSxqt+sdB!<nKz#MFzRI9WQL;526|N&eW9&!*To~i6T5ezK&7me
zb<A1LP?aqN?}>j=<%iH|>?=V=6^}%zJ~ofgXCF3?bd>hl<l43w+?(@Bz}1fU77htI
zFteKF-r73PK1{8+5GB`qYm4le^i-r%lw92ub@{hSQe^)Z5u7GV|1Qm)x$n}vkT(A&
z%?$O+@6tSSZDpOj;&VUHf!`-Af9W{CvTHl*B)`x7_ZLOJDbYnq0<5aHMFx!OZJjq8
zX8)1$T>_sOA|0<%;pLjp!>7sIBb}_bPSi<Qf5U1ayO%_;Zx@D7oDih{_A)6eQ#w}m
z?fCS^j8Oglk|`^rJ3Ger>>HBAZ1*|Qu{`GCt4}u3R&0HOruNAo6L?VY92=tUqh0TX
zyV0$GZ`sWUi61|l8<p=IUobPf5qtS|;e(_@8Ovx>j<#XAaozqq1*Lt`P|c_u4NRO~
z+9X>rRi;9;S9VRaN#pCpL*8x;3_Km70+Fn@<1Wexcx+g_PPRVwgRg&>Y}#gv$(r!=
zW=!vLa5srv=-|UID{c8k<~;u7>AkTUgO+Z?NIS*+!nDjBt&1pb@+eLL6r^cjJ!o~B
zA}3MnQeM}2D6K;%B>B#d_75&>(lagIx>u;~7kkaw8JYmYn<m%VFD?t*f2h5(s(vo2
zX!68N524;jFmA6+L6G_gkRjQ*?I%}RSQ|Wmg*2yGaF>fI9L}I>&3)_sA=7)e2g?w)
zw<h|sV7a=<{rAu(O>}g;SHj;Ds8Sv^EY88i1VY2ck|cDf=dd0Yc`ROJlY!owCN!V(
zVG*mE+gu!+3F8dgS3b8-1+I~8xE{Pj^V_b>r_D^Bteg!KoHTG<&YGs*D_pNsKmEq%
z=DEkZ#k>)G*L1u03F~C<|Ar${^^Mx{s4fuvK>ygbT>idwA+8@tahJZ8kpSQ|J7VAm
z_b$)!4^)>ZteRp)oT6e3;jp>9XTGXc0qPThU#l?@b`oKYCB>#6+toGcSIe?*!fH5+
zmCK|$D!n9^*?PBAzYz|v(pwq&@P>D(1eDV3F-XRD<9MHE@~^?wHlq+bYKdEsbNjbP
z6|k#{=FG(8rsrWw6Uj3hVnQ{!8$fsbdJZv>Akv*bUi#lkURe7dFu<H@l5?{BHcr|Z
zIq)dn{UBlmFIm<Jcbk>C5>uLTk<g&xPm%DGb<!M2KTaBDJ`1;NgGX1|?Z1!zCZfzg
zDOQF~<_Q>WVvJ=$tBbDs;T-EzJANY!3|3ez#e=oTjyt|nTR#1V(t6K5#XWU$Gf&oz
z<xx`N@L4f+dHPLv*FdrU_o$b`deZ4OrXqr~2w^ZtH&S(4S)}GNC4H6^bQoS69kF_#
z5W>>(^^p5CIKw<b5$j5SNVCvD_|5X7l4j29h+i>G?Z0)JiglFkB^&f}7-Y|DAvztd
zAvp2|&;3;Pf7Lu;P-|Uq7}N{2#4ZH5aAX`x`Mo2W!x<v@n?Mc#cfKQtR&oRMIF(&Y
z`F2#6b{8h78Lbfl`mfl9Ld9Tdb6Vk0cnt6LOl1vsL@w1;1)Czdr`Vg;6~fKX@Dtsk
zZd~;64T-i;RRL6?m>^QX$=8=f=FS+O*5I?8kVf7YPj$krm!iT%xU!<`s_oVW@^`k)
zoNi+)!7IOaeFwFbQA<gL&ehO^xL;1Y3nmE+3u{lR%VeUo5SGYJomtENy4`+vDrV9A
zVw~C9hgTWWb{h8D5^r20;(C>G^S0zR{35iBy|nQRm|$&o6OD$}vd**E^W3<7)!k2c
z14mz)_AXijN5>?CsL*!TDZH09dfd94bzh-~#gKY9lW<zcuPyatML`FQQUmpBd1ZmV
zj>g<C**Rt<AIBIG(Gx-P`4;E;mE|T}%jS}AI9fTFjh@#N*_#8CwgQikYAG<EkANlR
zk9{rKSKfqP4AIk9mCabjJa5~o3@7-^J2!)CkNLet`^zPli=(=9?41jCjPLJK`UqJz
z;N?&S^YA7$ZSag>LAq5L`8u?U!8CZV#%}a8JB!dDGC{@iV^hPKOlcQYj$ey|*XV}h
zn*1&d?3Hvc_|ZJoWedaI2x2bFT1Vg9V}hccutxyC#x%bt{Ucu6x*wxyeQy?8RM__j
z2gz(#GpNZ^YKbEInsDw@{}a3(lig`e?BhIXCuEZN%rH(XJ<j4lE7{J@Ep@G=v+j_w
z@al{B7kGNUfgtHf8iqn;v0svf!bcNbbsT2A7>4ofXID=lCacFA+~@Zi*Cj`H9DMM*
zpVqZo?#++$+(k~{x=ukxlg?||pYiSU6cl>L`j1zRWOI9B4;$>LD(}CY^k|E?oQ;rB
z!f?FAZz1wh*k>-T=vBceXfG(AqBW#3QAo#}FN65S_fZSz7u|H5@5?iAv*}ARD71$s
zPEGSjG?i=@{+QyFId1;P06$a2RY~9D@+euBobt?Iw6R0HGt708vk2m3)h1_n(|Xc9
z{FWA;={-!)F+#7cT3^e_DB9uv^xxPCGV#JJlgb7pEqBqJWKTArpzOEfd?YujR$V;9
zlT6P{Gt!mzjhHa|N6rs;`14Kg*ven5_e7Ru3tmoV$c~R7Ot}f5HKIdxt80GyNQ1OH
zO@B+BBBJT;><MWn6mQSNFvH3a#FyNm(rXFL6Y;N;IV-iyXTfWZZ#kESy~H;v$TswH
zo-ZCSf5LmMIu2{080K~0?HZbD%JcE?Y9+C?ZlnFf4{tT%inLc`q`fk#RME<sy}y0b
z_3-wP-L^{&t<MSxzMMv{j1f(lNAA|_)^a6-m&|xtOF5T5J1VFalyG)76557DFurQ~
z(=j}Ks;*mEM*!tRc!zsY<zpXK@5;+T0akDHI+E0BWi5WY(V&%vsj5n}&n`$$C@jz~
z+R00KVCaDC@<~8UCT~(EsSc#H(EBJYWcAODyol|`pWQP0v~Rd&XfI@7+BX!e=Fj$t
z#<Fv88#=^x{z+riuYBXUo=4d|A&(MZ^8*$6%R`kiW_L^61wDC-bvRK5w{It|7Y*Z#
zWip1wgCyP#R{DP3)+&jWj%BD}j+LN4E#~1}gw}!5vq|v{9!}C1IeAuifk#vQ;mZh_
zd5ULyCarr4rg&rAk|eSyqxE{9bH>+#(qm<-@;nt{NR5mv4bZfVIF9$4mZ`x9d#4Zh
zb}!@ECOp;aZ~mT9SqCo^RI2P93hmDYWE}Dp1=LO)0iAKXFPoOu*R~E1**++|7Dzqh
zdbEG#XC^@5PlS<wRBu{x{#Vtg$vJEl595J3;q{a!5(>jmM}W(UkX46xVav^Hc+Z`t
zX3t@**ZuKs=Di!TgR}iY94`+m2y+7pK5==&Tm!UA=N6t$b;)OXohO#LdLPvLImvE^
zh@@Ug>#e8>zSfmxa%;$*P*N8N2y1S%Fa3%nesO;Jd0G<(-fIB2b3C+)Kh25sDnPs$
z3NR>S`n}UT#B7mOPBbSz*)GgI8<r1Vi@el>($C=B<{Sx}C7yYI74v(Jhd0?f@+OP$
z$<5!;znp0GJbl*A#b9_TGC|X9GE-RuchlpfBnMBYuqg{ty0lZImOpp%4J#G#7~Z6`
zu<{1I_=6x0?mIXwG#r+8dHu!`gl}Y!^J~qMHQV=OEk2DH9Xji~a}LP9DEsdBud`!w
zO0R%FOz{Sf*yYNqlUMpyw5<%NBX~s;Iiq`corCbDJ%i#O$+k^;^B%gT8faO>YCb@i
zZjrV8orC5t{5Jn2+S}cqS+YutyDfLF121$1>#+vmaFpF8p8OL|^S{wsRAz9&!d-cx
z2`CBAR;&$nT_y4FokYaWf<j;r@hFGT9f0V=S;ALJjmdq47V&8|!av{8fC&yJx~Uoa
z$L;B@{F6SNA0D8&8?-osGfB64!s21hY8hMZYTJrtMAzCJ_a0k#_GWw#l4{J#fF?Xk
zT2*wBkRDr1@QELie>X7bX=IG-@BboR&_<o?qo!0GKVUFo_=N2xk-z!6#YLDjJ@#>!
zge%-73HlsM?@zggFdiIq>P{x07Z16}^1l$ycb-E_z(gQosJ>uNT(Q+_kJ97W6fMLC
zzHXYd8s0qh1b4xh7ykP7^vPy}nV5UoJ;lpH%08Q)3;Ii7q&1g|?GSD8t&-Aqnb2$p
z1abr8C*;PrAGp6nbiDZq+|PF!@?l#_5RU?X>yyyIK^L`Ca`=U#;J1NJVjp`BUmEc0
zQ{%OrDshM-ppZ~o_(sghGlb5VSygmRTMg6M_}(R9&wT<J*-9LOuRbVy)puLG!*Nj+
zRm3rrW1TjPT9a!l<(Q(8C%S)B%5|oyBAs(uy~w(VGrxODyIhEU80T!Fxc;{-Jo`2Y
zzBk~U19eS{>CdIO3NU5vPH%~T78p1D4hZ~t1V`K*PmJ9LuZ;ZIMF0M%4_YDFC88|?
z<ix9~M2oCj+%8OK&Hkc`HApC$YlR6_cqp?mh%Ql#`1jj!8DtM<WVziLmlh7zlj)Li
zH~1`GT776FDyumpS@D8j{w(g%N*`}U{v&i#sgFbxu3X=@P~NJmx2(5}&Ga0BL4nq!
zT3=cN<&Cn@YCRU6bgQi6aIUbaaJAp@TGkvljQ-AC9~Lf!mK>20+kzZ)Pk*baoI8Ls
zJf%XTOB0mH{n>p)?q1^XuuhfW=jh=6mVUhFd|B16h~^w!FZ)T9L}yDJY!Wu6Xe<*h
zbDzX@Np$HLIkA;9jQ_J}8p}33y}PB*=+#v$?@J5vs_@15LYwHNNY13@q`G3Os!X2g
zFc+EWkZ!-Qzv%l-ETmZn*13tC3n#L*h~HDr?FXHVPlC9$qY6h_czug@oC|tdSuf8G
zBZg0$!a89cF9{Nx53KND_8=ww$7p7Z+=!k!zXj?uKdN^xnkb-OTXMf055IF*=Jk8C
zyePW6=2-4BsK(T=`M{EAzM<O0)ivx=ACFWsZQ|T4OdnqS(Y97l<sq@E_lnGo+_T}{
z!a=-6HWn^e9VyhLk9>#mj#XB~XtPG@gH&>*?)pA$G|W*mY%0&{%2Em=mdf<nGy>$A
zMzuxPQ+iu#l36UPxoDCJ<8`IyAl3@&QX+$>(q?|Pg{1R{*5;g(%I<-r;hk*`X4iHK
z-xB5gWnnNu<$S@a>bb&I`l}l~HnJC!Qr@i*CFXcJXZrdGm^thT2%V5q_%I&6S!h4`
zrnh0DB>6Jt{9%T8RDciLIgt6OMoYUdN#+qX>qH+@2k2vp1+~{Ulvnlf(2SLcoF?`q
zy$2QvFN=ZxC<9QhWdBUDRHt*svXuCD^(y|Yk$tnBzX#{PqyBvQfa1i1zi)VYS)M;1
z0TIv5%bKD1@YdEiHLPi`m|sB2kRKEKy4ANrUi{;(VR9nOt;Ee+<{C|80%mDrme;ZP
z*Xeli>d7X9g*JI`pCQ`Z!pLvTFVD<`J)xoL)QOT*m%SI0Tce>nxw39o`?9DcN7k|f
z{RsOoh#XpNuo`3edGn<Mi$YX8i(laS?ZN)}F{GIgjLEb0Ei|pqrIoL&NnY^dS~=SB
z(-0i}I&*Q@Hpz1qgFNf=ZcwI0O*`J(MFnd?z`r<6{+r+gz1e{cmJ|PO{^pg#ISiw{
zlM2-TL*G_BN|?!08>4wrg@V^>nk_gUi%KtseFc|E?i5{lg-)(lWAeqg+uh)Tx{!Sy
zwT6l5EbG;jSNPGsdnM^z$ux}0p;+GN+(b>77zbR_*)&>b+{U-7EAa2t`#VO?P>947
zF`0SyYC@?AuAN-^`2z>k5Og+XbJ56oFhTcJ_;6MijfPg(g?Kfrn~w)s<JUVQ2xT`b
zUdPtsLmJhK<wkYi+akrdM@_r~HVASlrk3|&+2~$nN#1zfDkfRh#;buy@9jpv^SfAD
zgf3d8L$*+7*k@>_T1fC^C@IPLyWiUR(a7&?5mTDfuut3XS&zpG7O|HnYkPJ`Fmlg?
zMD3VJqi0k6d?0W`1+x2%cPF3J-<_{7hPqkeaVW`V0i0+yzSm^;lB}n|<A~-l6FwT)
zS&%gss2UeNXB<PU=g8J#XW6n<ewi$lt+ra<96W}d3#y+Jug&h?3XO?dDvz(*yZN+k
zvC5u?GLikMv#zE)_PpeXl8YC-`T&k3<W$RHmD4y^?fMeA1U9+6V~sYUs}-gfifZ4}
zJn=4Z?`k6OLmS4fZV1!k9XKRM27SADz8)kGy%@P4xz&*%S&s{S*m0p1yJoX_UCfI0
zb6n{W5VWUqNE@;blkBo6nK?znyPXsF6sydZWiKsMzI6m(*sOO~Ql^f8gJk2(!w;LA
zJ$3!{y147`tb#5MKJjv+uJU^0{f*~4rXD%_<upWaQEszTa+`I}FwvLU`@+F!>DrVW
z5x8#QhbPB;2=-1Z6bk={nxt!FAwcjZ5vZv9<#ftZ)O?&}16;PeKes<4g6F-TZCoPn
zFBg}$)O~OGo@2~KEJKP*Es>Ifw;yW&=~y9q0Z?lz6vYj<W~Ja&m&{2t0On(V`5pc7
zS^d+Gb%=*4iWI4<<|0{KyLtZB<>Q?uz^j)aJnrcd7s$;C!u!b=rpG8x5~0;&DNoV|
zM0o!H5&j>go`^Kvxk|sfCUpYGmI(aM7XE)$o&?ttQxyuvsP}VEQVppLT%G8$;5ihr
zw-b#l7+bM*r%hxrQ^Yv@W&?eLej553EhVXp4sGY*Gv=zFUwDUpoMQslLTF`7GD>kP
zRVwk7>~XA<F-G!u5hKUT-g7rf7>Y6`5L##*@hV=WX6XEa%BP>rj+~Z5t~;hGV;~vj
zW%Yt;N_?f*Rss8aiCl1}AjvkD=yoRXUQjDg<)!)#jIF)2!Fj=sdhucisTNu7Taq)8
zV*Y%}PGq`2Iurr=C)-SvzzF^}#d9t0IT)iaQT;B(yZ=Y{FHz5_%}f8mM5k1w*dUaK
z4}M}ZyE-Ie-({nj6Pd(CNzbnAmZ9;$PMueyJzgIUw=2rqIuNksWMnMeEXa9~6NVB(
zBKi-riVzhVS_3UIO{07>MSCf;JAFyem-8^qgh?Km67Q1Eo<>4==2JY=9M3(cb8fs)
z-qzAjG>dL;$}XZKK9%{!J!!s!P`4-WeH^{sp>{){Oh%u}9JSmy{WLSYu@l}jmhUPz
zbkB}iutcO-N+)}oxJw-z6p-|doYHnr=gn<tSZr;RpSzL0P%q^Mj}P%a0`@e-O?n#_
z+g>~!=U{59rhI`IF<D7;ZuPtq0Q+pmaoAy2fQ?MOST?>KO2wh3HYVZaZ1OqlGpmV|
zn}XC~Pv$sya#plxF5Hj3d5Y`0RwgXjOIhZHamI-8;p~Lqvdc(GNiLr)0a|(Uq8PuL
zQ8|Vl<twaV;1@-<cLl{{7dh$XuFOTb;v-T+olco^OUoI}d^U&&b|!g^DmzP+S2etQ
zY?IN-cDi7b-zg!(?mWTUM<<y&+`3+)p_JLNFxHa5C!1*Gw&Z{69HC~gQ8O=DPjbTP
z3`+V_*<BtLTDXW#lpCE3vaE)G|L_#OA$eG8NPS0d<LyMGW;|p%#<+K&f^73M;UV~|
znG%U3Aid!Tn9lM)u`6R^JL%qUB&U|Dp_N3*`-nNjl+td&A!({B@jsX%|JB8$IR<3N
z<T(2V_llH<=!sUF6*89MzI`hEyg$`o?Q`cE^|}jNHksQ*Bnw~$Qr)jKR)72ExWvB*
zNx}2BrQ)($r68BS|5Lx(HOn~0O_EAeDbJfkjx8WHC#ZdXFiagGz*n@WiU@edG?I%Q
zvmel0u_XxyB{@!TQ#fAtuR(gV08UYe!B}Buzw&roJ!k4c{N9^upw8-uJbfyh`a^St
zQ$RDw85vQKJEw{45|t|cuRvaukMnr<i7Zfzc+d#`mg?UN;4Of-VdC#?9cASC4=4)v
zU=cJ_yn@bH>8PUQH3&ooVP3Siy5#S-dWWWeasO8>z7OHIvTV+dU`@p{zibq=<0?Nc
zn?4_~yqBq+`WWsQ8o?)GUmXSYD%L43p4efF1oZu}TbKTV1&&>g%_E>S#K>Y(La1A)
z^zb+Mq|h4{1${Zpqek0`zDcpFAhF|9i!=Sw;QzHzQlqQD2^`2@#z-5AI0kciH=k_N
z3tQOWOw=yJ2^w&EZN^Fm3z0vKL273l0a=gCGzPKs90}FiHOpOffPdUc%~Si*iL*<i
ztFYuHVK;U!9-dJ({QQ7{hvazHQi&^C)4Carl8)J;#yLTnxaaI89O~u&f^#x@Pn9h(
zn#F;UsJs)0(~mc8mg+Wa=VLO>c>3~qpJQ1{=F&b>&wk+}Fl!F!LHkyz27-!hJRrt=
zraFYTVt(rFfP7bxnAYTVWyro}azRybdrR}<=D+9-_<faKL0o0u`70`#qrv|H^1eDg

literal 0
HcmV?d00001

diff --git a/gui/src/format-tokens.ts b/gui/src/format-tokens.ts
index bc53af6ae5..737a8dae6e 100644
--- a/gui/src/format-tokens.ts
+++ b/gui/src/format-tokens.ts
@@ -32,3 +32,24 @@ export function formatTokens(n: number, locale: string): string {
   if (n < 1_000_000_000_000) return `${trim((n / 1_000_000_000).toFixed(1))}B`;
   return `${trim((n / 1_000_000_000_000).toFixed(1))}T`;
 }
+
+/**
+ * A token total with its cached subset beside it: `5.8만 c5.7만`, `58K c57K`.
+ *
+ * A cached request's total is mostly cache. Printing the total alone makes a
+ * 58,000-token prompt that is 57,000 cache read and 1,000 fresh look like an
+ * ordinary 58,000-token prompt, and it reads as a different, smaller request
+ * than the log row directly below it, which already shows the companion. The
+ * `c` marker matches the `logs.tokens.cacheRead` label, which reads
+ * "cache read (c)".
+ *
+ * The companion is omitted only when there is no cache to report. It is NOT
+ * omitted when the cached subset equals the total: a turn served entirely from
+ * cache is the most interesting row on the page, and hiding its marker there
+ * would blank exactly the case this exists for.
+ */
+export function formatTokensWithCache(total: number, cached: number | undefined, locale: string): string {
+  const base = formatTokens(total, locale);
+  if (cached === undefined || !Number.isFinite(cached) || cached <= 0) return base;
+  return `${base} c${formatTokens(cached, locale)}`;
+}
diff --git a/gui/src/pages/Logs.tsx b/gui/src/pages/Logs.tsx
index 774efc455a..b3fa00b332 100644
--- a/gui/src/pages/Logs.tsx
+++ b/gui/src/pages/Logs.tsx
@@ -3,6 +3,7 @@ import { useVirtualizer } from "@tanstack/react-virtual";
 import { useI18n, LOCALES, type TFn } from "../i18n/shared";
 import { formatProviderDisplayName } from "../provider-icons";
 import { formatTokens } from "../format-tokens";
+import { formatTokensWithCache } from "../format-tokens";
 import { hashLogConversationQuery } from "../log-conversation-id";
 import { statusCodeInfo } from "../status-codes";
 import { IconX } from "../icons";
@@ -363,19 +364,27 @@ function formatLogDateTime(ts: number, localeTag?: string, timeZone?: string): s
 function summarizeFilteredLogs(entries: LogEntry[]): {
   requests: number;
   totalTokens: number;
+  cachedInputTokens: number;
   estimatedCostUsd: number;
   priorityLowerBound: boolean;
   unpricedRequests: number;
   unmeteredRequests: number;
 } {
   let totalTokens = 0;
+  let cachedInputTokens = 0;
   for (const entry of entries) {
     const tokens = displayTokenTotal(entry);
     if (tokens !== undefined) totalTokens += tokens;
+    // The banner sits directly above rows that already print `c <read>`, so a
+    // total with no companion read as a different, smaller figure than the rows
+    // it summarizes.
+    const read = cacheSplit(entry).read;
+    if (read !== undefined && read > 0) cachedInputTokens += read;
   }
   return {
     requests: entries.length,
     totalTokens,
+    cachedInputTokens,
     ...summarizeEstimatedCosts(entries),
   };
 }
@@ -687,7 +696,11 @@ export default function Logs({ apiBase }: { apiBase: string }) {
           <Notice tone="ok">
             {t("logs.conversation.totals", {
               requests: conversationTotals.requests,
-              tokens: formatTokens(conversationTotals.totalTokens, localeTag ?? locale),
+              tokens: formatTokensWithCache(
+                conversationTotals.totalTokens,
+                conversationTotals.cachedInputTokens,
+                localeTag ?? locale,
+              ),
               cost: formatEstimatedUsdValue(
                 conversationTotals.estimatedCostUsd,
                 t,
diff --git a/gui/src/pages/Usage.tsx b/gui/src/pages/Usage.tsx
index 96f0f1db0c..44028824b2 100644
--- a/gui/src/pages/Usage.tsx
+++ b/gui/src/pages/Usage.tsx
@@ -1,7 +1,7 @@
 import { useCallback, useEffect, useMemo, useRef, useState, type ReactNode } from "react";
 import { useI18n, type TFn, type Locale } from "../i18n/shared";
 import { formatProviderDisplayName } from "../provider-icons";
-import { formatTokens } from "../format-tokens";
+import { formatTokens, formatTokensWithCache } from "../format-tokens";
 import { formatEstimatedUsdValue as formatUsdEstimate } from "../intl-formatters";
 import { readSessionListCache, writeSessionListCache } from "../session-list-cache";
 import { EmptyState, Notice } from "../ui";
@@ -64,6 +64,10 @@ interface UsageModel {
   totalTokens: number;
   inputTokens: number;
   outputTokens: number;
+  // /api/usage has carried these all along; dropping them from the row type is
+  // what left the token column without its cached companion.
+  cachedInputTokens?: number;
+  cacheReadInputTokens?: number;
   shareRatio: number;
 }
 
@@ -74,6 +78,8 @@ interface UsageProvider {
   reportedRequests: number;
   estimatedRequests: number;
   totalTokens: number;
+  cachedInputTokens?: number;
+  cacheReadInputTokens?: number;
   shareRatio: number;
 }
 
@@ -561,7 +567,7 @@ function UsageModelsTable({
               <td className="muted">{formatProviderDisplayName(model.provider, t)}</td>
               <td className="num">{model.requests}</td>
               <td className="num">{model.measuredRequests}</td>
-              <td className="num mono">{formatTokens(model.totalTokens, locale)}</td>
+              <td className="num mono">{formatTokensWithCache(model.totalTokens, model.cacheReadInputTokens ?? model.cachedInputTokens, locale)}</td>
               <td><div className="usage-bar"><div className="usage-bar-fill" style={{ width: `${Math.round(model.shareRatio * 100)}%` }} /></div></td>
             </tr>
           ))}
@@ -621,7 +627,7 @@ function UsageProvidersTable({
               <td className="mono">{formatProviderDisplayName(provider.provider, t)}</td>
               <td className="num">{provider.requests}</td>
               <td className="num">{provider.measuredRequests}</td>
-              <td className="num mono">{formatTokens(provider.totalTokens, locale)}</td>
+              <td className="num mono">{formatTokensWithCache(provider.totalTokens, provider.cacheReadInputTokens ?? provider.cachedInputTokens, locale)}</td>
               <td><div className="usage-bar"><div className="usage-bar-fill" style={{ width: `${Math.round(provider.shareRatio * 100)}%` }} /></div></td>
             </tr>
           ))}
diff --git a/gui/src/pages/dashboard-overview-head.tsx b/gui/src/pages/dashboard-overview-head.tsx
index 44b3f8ac3c..fea1ae94e9 100644
--- a/gui/src/pages/dashboard-overview-head.tsx
+++ b/gui/src/pages/dashboard-overview-head.tsx
@@ -1,6 +1,6 @@
 import { IconAlert, IconInfo } from "../icons";
 import { type TKey, useT } from "../i18n/shared";
-import { formatTokens } from "../format-tokens";
+import { formatTokensWithCache } from "../format-tokens";
 import { formatUptime } from "../formatUptime";
 import { navigateHash } from "../hash-routing";
 import type { useDashboardData } from "./use-dashboard-data";
@@ -81,7 +81,13 @@ export function DashboardOverviewHead({
           <div className="stat" aria-busy={healthLoading || undefined}><div className="label">{t("dash.providers")}</div><div className="value">{providers.length}</div></div>
           <div className="stat" aria-busy={usageLoading || undefined}>
             <div className="label">{t("dash.tokens30d")}</div>
-            <div className="value mono">{usage30d && usage30d.summary.requests > 0 ? formatTokens(usage30d.summary.totalTokens, locale) : "—"}</div>
+            <div className="value mono">{usage30d && usage30d.summary.requests > 0
+              ? formatTokensWithCache(
+                usage30d.summary.totalTokens,
+                usage30d.summary.cacheReadInputTokens ?? usage30d.summary.cachedInputTokens,
+                locale,
+              )
+              : "—"}</div>
             <div className="muted text-label dash-stat-coverage">
               {usage30d && usage30d.summary.requests > 0
                 ? t("dash.coverage").replace("{pct}", `${Math.round(usage30d.summary.coverageRatio * 100)}%`)
diff --git a/gui/src/pages/dashboard-shared.ts b/gui/src/pages/dashboard-shared.ts
index 029e39b2da..cd0f7ac66d 100644
--- a/gui/src/pages/dashboard-shared.ts
+++ b/gui/src/pages/dashboard-shared.ts
@@ -123,7 +123,17 @@ export interface SidecarPatch {
   };
 }
 export interface ShadowCallData { enabled: boolean; model: string; sourceModels?: string[] }
-export interface UsageSummary30d { summary: { requests: number; totalTokens: number; coverageRatio: number } }
+export interface UsageSummary30d {
+  summary: {
+    requests: number;
+    totalTokens: number;
+    coverageRatio: number;
+    // Already on /api/usage; the tile showed a bare total only because this
+    // type dropped them.
+    cachedInputTokens?: number;
+    cacheReadInputTokens?: number;
+  };
+}
 export type UpdateChannel = "latest" | "preview";
 export type Installer = "npm" | "bun" | "source";
 export type UpdateJobStatus = "running" | "restarting" | "succeeded" | "failed";
diff --git a/scripts/test-layout/layout.json b/scripts/test-layout/layout.json
index 33b960ac70..18fc2060c0 100644
--- a/scripts/test-layout/layout.json
+++ b/scripts/test-layout/layout.json
@@ -718,6 +718,7 @@
     "grok-sync.test.ts": "providers/xai",
     "grok-writer-boundary.test.ts": "providers/xai",
     "gui-api-error.test.ts": "gui",
+    "gui-format-tokens-cache.test.ts": "gui",
     "gui-management-session.test.ts": "gui",
     "gui-pair-capability.test.ts": "gui",
     "gui-pair-client.test.ts": "gui",
diff --git a/src/cli/usage-report.ts b/src/cli/usage-report.ts
index 3311a781a1..2d2c525cde 100644
--- a/src/cli/usage-report.ts
+++ b/src/cli/usage-report.ts
@@ -17,6 +17,13 @@ interface CostRow {
   model?: string;
   requests: number;
   totalTokens: number;
+  /**
+   * Cache-read subset of the row's tokens. The API sends it; the CLI dropped it,
+   * so a mostly-cached provider's TOKENS column read as an ordinary total while
+   * the summary line two rows above already said `cached N`.
+   */
+  cachedInputTokens?: number;
+  cacheReadInputTokens?: number;
   estimatedCostUsd?: number;
 }
 
@@ -53,6 +60,8 @@ interface UsageReportInput {
     ambiguous?: boolean;
     requests: number;
     totalTokens: number;
+    cachedInputTokens?: number;
+    cacheReadInputTokens?: number;
     estimatedCostUsd?: number;
   }[];
 }
@@ -76,6 +85,16 @@ function count(value: number | undefined): string {
   return typeof value === "number" && Number.isFinite(value) ? value.toLocaleString("en-US") : "—";
 }
 
+/**
+ * A row's token total with its cache-read subset, matching the summary line's
+ * `cached N` wording rather than inventing a second vocabulary for the tables.
+ */
+function countWithCache(total: number | undefined, cached: number | undefined): string {
+  const base = count(total);
+  if (typeof cached !== "number" || !Number.isFinite(cached) || cached <= 0) return base;
+  return `${base} (cached ${count(cached)})`;
+}
+
 /**
  * Matches the dashboard's `~$` with four fraction digits. Estimates below a
  * hundredth of a cent still read as a number rather than collapsing to $0.00,
@@ -141,7 +160,12 @@ export function formatUsageReport(data: UsageReportInput): string[] {
     lines.push("");
     lines.push(...table(
       ["PROVIDER", "REQUESTS", "TOKENS", "EST. COST"],
-      providers.map(row => [row.provider, count(row.requests), count(row.totalTokens), usd(row.estimatedCostUsd)]),
+      providers.map(row => [
+        row.provider,
+        count(row.requests),
+        countWithCache(row.totalTokens, row.cacheReadInputTokens ?? row.cachedInputTokens),
+        usd(row.estimatedCostUsd),
+      ]),
     ));
   }
 
@@ -163,7 +187,7 @@ export function formatUsageReport(data: UsageReportInput): string[] {
         // wrong conclusion. Mark it rather than presenting it as a single identity.
         row.ambiguous ? `${terminalText(row.accountLogLabel)} (ambiguous)` : terminalText(row.accountLogLabel),
         count(row.requests),
-        count(row.totalTokens),
+        countWithCache(row.totalTokens, row.cacheReadInputTokens ?? row.cachedInputTokens),
         usd(row.estimatedCostUsd),
       ]),
     ));
@@ -175,7 +199,13 @@ export function formatUsageReport(data: UsageReportInput): string[] {
     const shown = models.slice(0, MAX_MODEL_ROWS);
     lines.push(...table(
       ["MODEL", "PROVIDER", "REQUESTS", "TOKENS", "EST. COST"],
-      shown.map(row => [row.model ?? "-", row.provider, count(row.requests), count(row.totalTokens), usd(row.estimatedCostUsd)]),
+      shown.map(row => [
+        row.model ?? "-",
+        row.provider,
+        count(row.requests),
+        countWithCache(row.totalTokens, row.cacheReadInputTokens ?? row.cachedInputTokens),
+        usd(row.estimatedCostUsd),
+      ]),
     ));
     if (models.length > shown.length) {
       lines.push(`... ${models.length - shown.length} more (use --json)`);
diff --git a/tests/cli/cli-usage-report.test.ts b/tests/cli/cli-usage-report.test.ts
index 5399137a57..1be03f68f2 100644
--- a/tests/cli/cli-usage-report.test.ts
+++ b/tests/cli/cli-usage-report.test.ts
@@ -404,3 +404,28 @@ describe("ocx logs --follow output contract", () => {
     }
   });
 });
+
+describe("cached tokens in the per-row tables", () => {
+  test("a provider and model row name their cache-read subset", () => {
+    // The summary line has always said "cached N". The tables below it printed a
+    // bare total, so a mostly-cached provider looked like an ordinary one.
+    const lines = formatUsageReport({
+      range: "today",
+      summary: { requests: 1, totalTokens: 58_000, cachedInputTokens: 57_000 },
+      providers: [{ provider: "devin-cli", requests: 1, totalTokens: 58_000, cacheReadInputTokens: 57_000 }],
+      models: [{ provider: "devin-cli", model: "swe-2", requests: 1, totalTokens: 58_000, cachedInputTokens: 57_000 }],
+    }).join("\n");
+    expect(lines).toContain("58,000 (cached 57,000)");
+    expect(lines.match(/cached 57,000/g)?.length).toBeGreaterThanOrEqual(2);
+  });
+
+  test("a provider that reports no cache keeps a bare total", () => {
+    const lines = formatUsageReport({
+      range: "today",
+      summary: { requests: 1, totalTokens: 58_000 },
+      providers: [{ provider: "xai", requests: 1, totalTokens: 58_000 }],
+    }).join("\n");
+    expect(lines).toContain("58,000");
+    expect(lines).not.toContain("cached");
+  });
+});
diff --git a/tests/fixtures/test-layout-expected.json b/tests/fixtures/test-layout-expected.json
index 9ea5f32928..5e57040565 100644
--- a/tests/fixtures/test-layout-expected.json
+++ b/tests/fixtures/test-layout-expected.json
@@ -549,6 +549,7 @@
   "grok-sync.test.ts": "providers/xai",
   "grok-writer-boundary.test.ts": "providers/xai",
   "gui-api-error.test.ts": "gui",
+  "gui-format-tokens-cache.test.ts": "gui",
   "gui-management-session.test.ts": "gui",
   "gui-pair-capability.test.ts": "gui",
   "gui-pair-client.test.ts": "gui",
diff --git a/tests/gui/gui-format-tokens-cache.test.ts b/tests/gui/gui-format-tokens-cache.test.ts
new file mode 100644
index 0000000000..fe38fb81da
--- /dev/null
+++ b/tests/gui/gui-format-tokens-cache.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, test } from "bun:test";
+import { formatTokens, formatTokensWithCache } from "../../gui/src/format-tokens";
+
+/**
+ * A cached request's total is mostly cache. The logs table has always shown the
+ * total with a stacked `c <read>`; every other surface printed the total alone,
+ * which reads as a different, smaller request than the rows beside it.
+ */
+describe("formatTokensWithCache", () => {
+  test("renders the cached subset beside the total in both number scales", () => {
+    expect(formatTokensWithCache(58_000, 57_000, "ko")).toBe("5.8만 c5.7만");
+    expect(formatTokensWithCache(58_000, 57_000, "en")).toBe("58K c57K");
+    expect(formatTokensWithCache(58_000, 57_000, "zh")).toBe("5.8万 c5.7万");
+  });
+
+  test("a provider that reports no cache is left exactly as it was", () => {
+    for (const cached of [undefined, 0, Number.NaN]) {
+      expect(formatTokensWithCache(58_000, cached, "ko")).toBe(formatTokens(58_000, "ko"));
+    }
+    // A negative count is nonsense rather than a cache miss; treat it as absent.
+    expect(formatTokensWithCache(58_000, -1, "en")).toBe("58K");
+  });
+
+  test("a turn served entirely from cache still shows the marker", () => {
+    // This is the most cached row on the page. Hiding the companion when the
+    // subset equals the total would blank exactly the case worth showing.
+    expect(formatTokensWithCache(57_000, 57_000, "en")).toBe("57K c57K");
+  });
+});

From 1e28e62360a093b663e3d652eee2044f83584cfb Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 13 Sep 2026 00:26:22 +0900
Subject: [PATCH 16/17] fix(devin): read usage from ModelUsageStats and
 classify cloud failures (#4419)

* fix(devin): read usage from ModelUsageStats and classify cloud failures

A cached Devin turn reported a bare token total with no cached subset, so
its log row looked like a smaller request than it was.

The decoder was reading GetChatMessageResponse field 28. Field 28 is
response_dimension_groups, the rows the IDE renders; field 7 is
ModelUsageStats, the per-turn accounting. The old path worked by accident:
ResponseDimension.uid is that message's field 5, which the entry walker
treats as a metric id, so cache numbers appeared only when the service
happened to render cache rows. Field 7 carries cache read and cache write
unconditionally.

Both fields arrive in the same message and the adapter keeps the last usage
event, so decoding both is not enough: field 7 now suppresses field 28
within a message and is yielded last, and it needs its own uint64 decoder
because the field-28 walker reads a fixed32 float out of a sub-message.

Whether Cognition's input_tokens already includes cache is unsettled, and
guessing inclusive is the expensive error: normalizeCostTokens only rejects
read + write > input, so an inflated input passes validation and bills
cached tokens at the uncached rate. The mapping is therefore derived from
the frame. Both branches agree on the 58k-prompt case that prompted this.

Two further classification defects. CloudChatError carried no HTTP status,
so inferHttpStatusFromAdapterMessage turned an upstream 429 into a 502 and
core's failover never rotated or backed off. And a cancelled turn said
"Devin turn was aborted.", which isClientClosedMessage does not recognise,
so a client hanging up was logged as an upstream failure; it now emits the
phrase the classifier knows, with status 499.

Usage frames are merged per field instead of replaced, because the counters
are cumulative and a later partial frame used to zero an earlier count.

* fix(devin): report field-7 usage ahead of finish and derive the merged total

Review follow-ups on the usage decode.

The authoritative ModelUsageStats event was yielded after the rest of the
frame, so a frame that also carried finish reported usage behind the turn's
end. It is now yielded first, which makes the order independent of where
the service places the field.

mergeDevinUsage took the max of two totals alongside the per-field maxima,
which can leave totalTokens different from input + output; the cost and log
paths read that total. The total is now derived from the merged counts.

Regression coverage for what the change is actually for: field 7 suppressing
the display rows within one frame and landing before finish, the display
rows still decoding when no field 7 is present, a partial frame not zeroing
an earlier count, and an HTTP status becoming a structured classification.

A Connect trailer still carries no HTTP status, so a cap delivered that way
keeps the older message-inference path. That is noted at the throw site as
a follow-up rather than silently left open.
---
 src/adapters/devin.ts                   |  70 ++++++++++++--
 src/adapters/devin/cloud-direct/chat.ts | 108 +++++++++++++++++++++-
 tests/providers/devin-hardening.test.ts | 118 ++++++++++++++++++++++++
 3 files changed, 287 insertions(+), 9 deletions(-)

diff --git a/src/adapters/devin.ts b/src/adapters/devin.ts
index 12d9ab7ee2..5bbd65c480 100644
--- a/src/adapters/devin.ts
+++ b/src/adapters/devin.ts
@@ -13,6 +13,53 @@ import { getCachedCatalog } from "./devin/cloud-direct/catalog";
 import { buildNonOpenAIToolCatalogNudgeForTools } from "./tool-catalog-nudge";
 import { DEVIN_DEFAULT_API_SERVER, resolveDevinApiServer } from "../oauth/devin";
 
+/**
+ * Combine two usage frames from one turn by keeping the larger count per field.
+ *
+ * Devin's counters are cumulative within a turn, so a frame that reports less
+ * than an earlier one is reporting a subset, not a correction.
+ */
+export function mergeDevinUsage(previous: OcxUsage, next: OcxUsage): OcxUsage {
+  const keys = [
+    "inputTokens", "outputTokens",
+    "cachedInputTokens", "cacheReadInputTokens", "cacheCreationInputTokens",
+    "reasoningOutputTokens",
+  ] as const;
+  const merged: OcxUsage = { ...previous, ...next };
+  for (const key of keys) {
+    const a = previous[key];
+    const b = next[key];
+    if (typeof a === "number" && typeof b === "number") merged[key] = Math.max(a, b);
+    else if (typeof a === "number" && b === undefined) merged[key] = a;
+  }
+  // totalTokens is derived, not merged. Taking the max of two totals alongside
+  // per-field maxima can leave total !== input + output, and the cost and log
+  // paths read the total.
+  const total = (merged.inputTokens ?? 0) + (merged.outputTokens ?? 0);
+  if (total > 0) merged.totalTokens = total;
+  return merged;
+}
+
+/**
+ * The wording `isClientClosedMessage` recognises.
+ *
+ * "Devin turn was aborted." matched nothing, so a cancelled turn fell through to
+ * the default inference and was logged as a 502 upstream failure rather than as
+ * the client hanging up.
+ */
+const DEVIN_CLIENT_CLOSED_MESSAGE = "client closed request";
+
+/** Map a cloud-direct failure onto the structured fields the error event carries. */
+export function devinErrorClassification(error: unknown): { status?: number; errorType?: string; retryable?: boolean } {
+  const status = error instanceof CloudChatError ? error.status : undefined;
+  if (status === undefined) return {};
+  if (status === 401) return { status, errorType: "authentication_error", retryable: false };
+  if (status === 403) return { status, errorType: "permission_error", retryable: false };
+  if (status === 429) return { status, errorType: "rate_limit_error", retryable: true };
+  if (status >= 500) return { status, retryable: true };
+  return { status, retryable: false };
+}
+
 export const DEVIN_API_SERVER = DEVIN_DEFAULT_API_SERVER;
 
 const EFFORT_SUFFIXES = new Set(["low", "medium", "high", "xhigh", "max", "none", "1m", "max-1m", "none-1m", "fast"]);
@@ -210,7 +257,7 @@ export function createDevinAdapter(
 
     async runTurn(parsed: OcxParsedRequest, incoming: IncomingMeta, emit: (event: AdapterEvent) => void) {
       if (incoming.abortSignal?.aborted) {
-        emit({ type: "error", message: "Devin turn was aborted before start." });
+        emit({ type: "error", message: DEVIN_CLIENT_CLOSED_MESSAGE, status: 499, retryable: false });
         return;
       }
       let apiKey: string;
@@ -272,7 +319,7 @@ export function createDevinAdapter(
             // Say what happened instead, the way the other runTurn-only adapter
             // does, and carry any usage already seen.
             closeOpenTool();
-            emit({ type: "error", message: "Devin turn was aborted.", ...(usage ? { usage } : {}) });
+            emit({ type: "error", message: DEVIN_CLIENT_CLOSED_MESSAGE, status: 499, retryable: false, ...(usage ? { usage } : {}) });
             return;
           }
           if (event.kind === "text") {
@@ -305,7 +352,7 @@ export function createDevinAdapter(
           }
           if (event.kind === "usage") {
             const total = event.totalTokens ?? ((event.promptTokens ?? 0) + (event.completionTokens ?? 0));
-            usage = {
+            const next: OcxUsage = {
               inputTokens: event.promptTokens ?? 0,
               outputTokens: event.completionTokens ?? 0,
               ...(total > 0 ? { totalTokens: total } : {}),
@@ -313,19 +360,24 @@ export function createDevinAdapter(
               ...(event.cacheCreationInputTokens !== undefined ? { cacheCreationInputTokens: event.cacheCreationInputTokens } : {}),
               ...(event.reasoningTokens !== undefined ? { reasoningOutputTokens: event.reasoningTokens } : {}),
             };
+            // Merge rather than replace. A turn can carry more than one usage
+            // frame, and the counters are cumulative, so a later partial frame
+            // that omits a field used to zero a count the earlier frame had
+            // already reported.
+            usage = usage ? mergeDevinUsage(usage, next) : next;
             continue;
           }
         }
         closeOpenTool();
         if (incoming.abortSignal?.aborted) {
-          emit({ type: "error", message: "Devin turn was aborted.", ...(usage ? { usage } : {}) });
+          emit({ type: "error", message: DEVIN_CLIENT_CLOSED_MESSAGE, status: 499, retryable: false, ...(usage ? { usage } : {}) });
         } else {
           emit({ type: "done", ...(usage ? { usage } : {}), ...(stopReason ? { stopReason } : {}) });
         }
       } catch (error) {
         closeOpenTool();
         if (incoming.abortSignal?.aborted) {
-          emit({ type: "error", message: "Devin turn was aborted.", ...(usage ? { usage } : {}) });
+          emit({ type: "error", message: DEVIN_CLIENT_CLOSED_MESSAGE, status: 499, retryable: false, ...(usage ? { usage } : {}) });
           return;
         }
         const message = error instanceof CloudChatError
@@ -333,7 +385,13 @@ export function createDevinAdapter(
           : error instanceof Error ? error.message : String(error);
         // Usage that already arrived is still real; dropping it loses the
         // accounting for a turn that did most of its work before failing.
-        emit({ type: "error", message, ...(usage ? { usage } : {}) });
+        emit({
+          type: "error",
+          message,
+          ...devinErrorClassification(error),
+          ...(error instanceof CloudChatError && error.code ? { code: error.code } : {}),
+          ...(usage ? { usage } : {}),
+        });
       }
     },
   };
diff --git a/src/adapters/devin/cloud-direct/chat.ts b/src/adapters/devin/cloud-direct/chat.ts
index 334156daf9..2c7b7c32a1 100644
--- a/src/adapters/devin/cloud-direct/chat.ts
+++ b/src/adapters/devin/cloud-direct/chat.ts
@@ -669,7 +669,30 @@ function buildGetChatMessageRequest(args: BuildArgs): Buffer {
  * any non-zero to 'tool_calls' for now (and let the caller fall back to
  * 'stop' if no tool_call deltas were emitted).
  */
-function* decodeChatFrame(proto: Buffer): Generator<CloudChatEvent> {
+export function* decodeChatFrame(proto: Buffer): Generator<CloudChatEvent> {
+  // Field 7 is `ModelUsageStats`, the authoritative per-turn accounting, and
+  // field 28 is `response_dimension_groups` — the rows the IDE renders. The
+  // decoder below reads 28 because a capture happened to expose metric-looking
+  // strings there (`ResponseDimension.uid` is its field 5, which is what the
+  // entry walker treats as `metric_id`), and that works only when the service
+  // chose to render cache rows. Field 7 carries cache read and cache write
+  // unconditionally, which is why a cached Devin turn used to report a bare
+  // total with no cached subset.
+  //
+  // Both fields arrive in the same message and the adapter keeps the last usage
+  // event it sees, so this cannot be a plain "decode both": field 7 has to
+  // suppress field 28 within the message. It is yielded before the rest of the
+  // frame rather than after it, so a frame that also carries finish (field 5)
+  // still reports usage ahead of the turn's end, and the order does not depend
+  // on where the service happens to place the field.
+  let authoritativeUsage: CloudChatEvent | null = null;
+  for (const f of iterFields(proto)) {
+    if (f.num === 7 && f.wire === 2 && Buffer.isBuffer(f.value)) {
+      authoritativeUsage = decodeModelUsageStats(f.value as Buffer);
+      if (authoritativeUsage) break;
+    }
+  }
+  if (authoritativeUsage) yield authoritativeUsage;
   for (const f of iterFields(proto)) {
     if (f.num === 3 && f.wire === 2 && Buffer.isBuffer(f.value)) {
       // Visible delta_text — what the user should SEE in the chat.
@@ -740,6 +763,7 @@ function* decodeChatFrame(proto: Buffer): Generator<CloudChatEvent> {
       // else stays 'stop' for 0/2/4-9/12/13
       yield { kind: 'finish', reason };
     } else if (f.num === 28 && f.wire === 2 && Buffer.isBuffer(f.value)) {
+      if (authoritativeUsage) continue;
       const usage = decodeUsageBlock(f.value as Buffer);
       if (usage) yield usage;
     }
@@ -834,6 +858,68 @@ function decodeUsageBlock(buf: Buffer): CloudChatEvent | null {
   };
 }
 
+/**
+ * `exa.codeium_common_pb.ModelUsageStats` at GetChatMessageResponse field 7.
+ *
+ *   ModelUsageStats {
+ *     #2 input_tokens        uint64
+ *     #3 output_tokens       uint64
+ *     #4 cache_write_tokens  uint64
+ *     #5 cache_read_tokens   uint64
+ *   }
+ *
+ * Plain varints, so the field-28 entry walker — which descends a
+ * length-delimited sub-message and reads a fixed32 float — cannot read this at
+ * all. It needs its own decoder.
+ *
+ * Whether Cognition's `input_tokens` already includes the cached tokens is not
+ * settled. oh-my-pi sums all four into its total, which suggests exclusive, but
+ * that is their convention rather than a measurement of this field. Guessing
+ * wrong in the inclusive direction is the expensive mistake: `normalizeCostTokens`
+ * only rejects `read + write > input`, so an inflated input passes validation and
+ * bills cached tokens at the uncached rate.
+ *
+ * So the shape is derived from the frame instead of assumed. An input that
+ * already covers the cache is left alone; one that cannot possibly cover it is
+ * folded. Both branches agree on the case that motivated this — a 58k prompt
+ * that is 57k cache read and 1k fresh reads as 58k with a 57k cached subset —
+ * and neither can emit `read + write > input`. Replace the derivation with a
+ * fixed mapping once a live frame settles the question.
+ */
+export function decodeModelUsageStats(buf: Buffer): CloudChatEvent | null {
+  let wireInput: number | undefined;
+  let output: number | undefined;
+  let cacheWrite: number | undefined;
+  let cacheRead: number | undefined;
+  for (const f of iterFields(buf)) {
+    if (f.wire !== 0) continue;
+    const n = Number(f.value);
+    if (!Number.isFinite(n) || n < 0) continue;
+    if (f.num === 2) wireInput = n;
+    else if (f.num === 3) output = n;
+    else if (f.num === 4) cacheWrite = n;
+    else if (f.num === 5) cacheRead = n;
+  }
+  if (wireInput === undefined && output === undefined && cacheRead === undefined && cacheWrite === undefined) {
+    return null;
+  }
+  const read = cacheRead ?? 0;
+  const write = cacheWrite ?? 0;
+  const rawInput = wireInput ?? 0;
+  const promptTokens = rawInput >= read + write ? rawInput : rawInput + read + write;
+  const completionTokens = output ?? 0;
+  const total = promptTokens + completionTokens;
+  return {
+    kind: 'usage',
+    promptTokens,
+    completionTokens,
+    totalTokens: total > 0 ? total : undefined,
+    cachedInputTokens: cacheRead,
+    cacheCreationInputTokens: cacheWrite,
+    reasoningTokens: undefined,
+  };
+}
+
 // ----------------------------------------------------------------------------
 // Public API: streamChat
 // ----------------------------------------------------------------------------
@@ -864,7 +950,18 @@ export interface CloudChatRequest {
 }
 
 export class CloudChatError extends Error {
-  constructor(message: string, public readonly code?: string, public readonly traceId?: string) {
+  constructor(
+    message: string,
+    public readonly code?: string,
+    public readonly traceId?: string,
+    /**
+     * Upstream HTTP status, when the failure was a status line rather than a
+     * Connect trailer. Without it the adapter's message reaches
+     * `inferHttpStatusFromAdapterMessage`, which does not parse `HTTP 429`, so
+     * a live rate limit was classified 502 and core's failover never rotated.
+     */
+    public readonly status?: number,
+  ) {
     super(message);
     this.name = 'CloudChatError';
   }
@@ -987,7 +1084,12 @@ export async function* streamChatEvents(req: CloudChatRequest): AsyncGenerator<C
     // The body is not echoed into the message. This error reaches the adapter's
     // error event and /api/logs, and a Connect error can quote the request that
     // produced it - which is the request holding the api_key.
-    throw new CloudChatError(`GetChatMessage failed (HTTP ${resp.status})`, undefined);
+    //
+    // Only the HTTP status line is carried here. A Connect EOS trailer that
+    // reports resource_exhausted or unavailable still arrives without a status,
+    // so a cap delivered that way keeps the older message-inference path.
+    // Mapping trailer codes onto HTTP statuses is deliberately a follow-up.
+    throw new CloudChatError(`GetChatMessage failed (HTTP ${resp.status})`, undefined, undefined, resp.status);
   }
   if (!resp.body) {
     throw new CloudChatError('GetChatMessage response had no body stream');
diff --git a/tests/providers/devin-hardening.test.ts b/tests/providers/devin-hardening.test.ts
index c793162ce3..4b73c8e20f 100644
--- a/tests/providers/devin-hardening.test.ts
+++ b/tests/providers/devin-hardening.test.ts
@@ -5,6 +5,9 @@ import { DEVIN_DEFAULT_API_SERVER, resolveDevinApiBaseUrl, validateDevinApiBaseU
 import { registerUser } from "../../src/oauth/devin/register-user";
 import { anySignal } from "../../src/lib/abort";
 import { buildGetChatMessageRequestForTests } from "../../src/adapters/devin/cloud-direct/chat";
+import { decodeModelUsageStats } from "../../src/adapters/devin/cloud-direct/chat";
+import { CloudChatError, decodeChatFrame } from "../../src/adapters/devin/cloud-direct/chat";
+import { devinErrorClassification, mergeDevinUsage } from "../../src/adapters/devin";
 import { iterFields } from "../../src/adapters/devin/cloud-direct/wire";
 import { buildMetadata, normalizeDevinSessionToken } from "../../src/adapters/devin/cloud-direct/metadata";
 
@@ -280,3 +283,118 @@ describe("devin session-token normalization", () => {
     }
   });
 });
+
+describe("devin ModelUsageStats decode (response field 7)", () => {
+  function varint(num: number, value: number): Buffer {
+    const out: number[] = [(num << 3) | 0];
+    let v = value;
+    do { const b = v & 0x7f; v = Math.floor(v / 128); out.push(v > 0 ? b | 0x80 : b); } while (v > 0);
+    return Buffer.from(out);
+  }
+  const stats = (input: number, output: number, write: number, read: number) =>
+    Buffer.concat([varint(2, input), varint(3, output), varint(4, write), varint(5, read)]);
+
+  test("an exclusive frame folds cache into the inclusive input this repo reports", () => {
+    // 1k fresh + 57k cache read is the 58k prompt the user sees as one number.
+    const u = decodeModelUsageStats(stats(1_000, 200, 0, 57_000));
+    expect(u?.promptTokens).toBe(58_000);
+    expect(u?.cachedInputTokens).toBe(57_000);
+    expect(u?.totalTokens).toBe(58_200);
+  });
+
+  test("an already-inclusive frame is left alone rather than inflated", () => {
+    const u = decodeModelUsageStats(stats(58_000, 200, 0, 57_000));
+    expect(u?.promptTokens).toBe(58_000);
+    expect(u?.cachedInputTokens).toBe(57_000);
+    // normalizeCostTokens only rejects read + write > input, so an inflated
+    // input would pass validation and bill cache at the uncached rate.
+    expect(u!.cachedInputTokens! + (u!.cacheCreationInputTokens ?? 0)).toBeLessThanOrEqual(u!.promptTokens!);
+  });
+
+  test("cache write counts as prompt too, and an empty message decodes to nothing", () => {
+    const u = decodeModelUsageStats(stats(1_000, 0, 4_000, 0));
+    expect(u?.promptTokens).toBe(5_000);
+    expect(u?.cacheCreationInputTokens).toBe(4_000);
+    expect(decodeModelUsageStats(Buffer.alloc(0))).toBeNull();
+  });
+});
+
+describe("devin frame-level usage precedence and classification", () => {
+  // Tags above 15 need a multi-byte varint: field 28 wire 2 is 226, and
+  // writing that as one raw byte sets the continuation bit and swallows the
+  // next byte.
+  function uvarint(value: number): number[] {
+    const out: number[] = [];
+    let v = value;
+    do { const b = v & 0x7f; v = Math.floor(v / 128); out.push(v > 0 ? b | 0x80 : b); } while (v > 0);
+    return out;
+  }
+  function varint(num: number, value: number): Buffer {
+    return Buffer.from([...uvarint((num << 3) | 0), ...uvarint(value)]);
+  }
+  function lenDelim(num: number, payload: Buffer): Buffer {
+    return Buffer.concat([Buffer.from([...uvarint((num << 3) | 2), ...uvarint(payload.length)]), payload]);
+  }
+  // ResponseDimensionGroup carrying a cumulative metric whose uid reads like a
+  // metric id — the shape the old decoder mined for usage.
+  function displayGroup(uid: string, value: number): Buffer {
+    const f32 = Buffer.alloc(5);
+    f32.writeUInt8((2 << 3) | 5, 0);
+    f32.writeFloatLE(value, 1);
+    const entry = Buffer.concat([lenDelim(4, f32), lenDelim(5, Buffer.from(uid, "utf8"))]);
+    return lenDelim(2, entry);
+  }
+
+  test("field 7 suppresses the display rows and is reported before finish", () => {
+    const stats = Buffer.concat([varint(2, 1_000), varint(3, 200), varint(4, 0), varint(5, 57_000)]);
+    const frame = Buffer.concat([
+      lenDelim(7, stats),
+      varint(5, 2),                                   // stop_reason STOP_PATTERN
+      lenDelim(28, displayGroup("input_tokens", 999)), // the wrong, display-derived number
+    ]);
+    const events = [...decodeChatFrame(frame)];
+    const usages = events.filter(e => e.kind === "usage");
+    expect(usages).toHaveLength(1);
+    expect(usages[0]!.promptTokens).toBe(58_000);
+    expect(usages[0]!.cachedInputTokens).toBe(57_000);
+    // Ahead of finish, so ordering does not depend on where the service puts
+    // the field.
+    expect(events.findIndex(e => e.kind === "usage"))
+      .toBeLessThan(events.findIndex(e => e.kind === "finish"));
+  });
+
+  test("a frame with no field 7 still falls back to the display rows", () => {
+    const frame = lenDelim(28, Buffer.concat([
+      displayGroup("input_tokens", 4_000),
+      displayGroup("output_tokens", 100),
+    ]));
+    const usages = [...decodeChatFrame(frame)].filter(e => e.kind === "usage");
+    expect(usages).toHaveLength(1);
+    expect(usages[0]!.promptTokens).toBe(4_000);
+  });
+});
+
+describe("devin usage merging and error classification", () => {
+  test("a later partial frame cannot zero an earlier count, and the total stays derived", () => {
+    const merged = mergeDevinUsage(
+      { inputTokens: 58_000, outputTokens: 200, totalTokens: 58_200, cachedInputTokens: 57_000 },
+      { inputTokens: 58_000, outputTokens: 900 },
+    );
+    expect(merged.cachedInputTokens).toBe(57_000);
+    expect(merged.outputTokens).toBe(900);
+    // Taking the max of two totals alongside per-field maxima would leave
+    // 58,200 here, which no longer equals input + output.
+    expect(merged.totalTokens).toBe(58_900);
+  });
+
+  test("an HTTP status on the cloud error becomes a structured classification", () => {
+    expect(devinErrorClassification(new CloudChatError("x", undefined, undefined, 429)))
+      .toEqual({ status: 429, errorType: "rate_limit_error", retryable: true });
+    expect(devinErrorClassification(new CloudChatError("x", undefined, undefined, 401)))
+      .toEqual({ status: 401, errorType: "authentication_error", retryable: false });
+    expect(devinErrorClassification(new CloudChatError("x", undefined, undefined, 503)))
+      .toEqual({ status: 503, retryable: true });
+    // A Connect trailer carries no status, so it keeps the older inference path.
+    expect(devinErrorClassification(new CloudChatError("x", "resource_exhausted"))).toEqual({});
+  });
+});

From 92e21bc8eff2c847b6406915255e044819d37c72 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 13 Sep 2026 00:53:21 +0900
Subject: [PATCH 17/17] fix(devin): map Connect trailer codes onto the status
 core acts on (#4423)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(devin): map Connect trailer codes onto the status core acts on

Only the HTTP status line carried a status, so a cap or an expired
credential delivered as a Connect EOS trailer fell through to
inferHttpStatusFromAdapterMessage and became a generic 502 — not an auth
prompt, not a backoff, and nothing core's failover acts on.

connectTrailerHttpStatus maps the Connect codes Cognition actually sends,
and treats permission_denied carrying "your limit will reset" or "reached
overall message rate limit" as the quota refusal it is rather than an
authorization failure. It reads the raw trailer message, not the enriched
text, so the tool-blocklist wrapper cannot trip the quota regex. An
unrecognised code returns undefined and keeps the older inference path.

Review follow-up in the same change: unimplemented maps to 501, and the
blanket "5xx is retryable" rule was putting retryable: true on the SSE
failure a client reads for a call the service will never implement.

* docs(devlog): record the trailer-status mapping as closed

020 listed the Connect trailer mapping as the deferred half of the cloud-direct work. It landed, along with the 501 retryability fix the review caught, so the doc records the outcome and the two accepted residuals.
---
 .../020_cloud_direct_hardening.md             | 15 +++++
 src/adapters/devin.ts                         |  4 ++
 src/adapters/devin/cloud-direct/chat.ts       | 67 +++++++++++++++++--
 tests/providers/devin-hardening.test.ts       | 46 +++++++++++++
 4 files changed, 125 insertions(+), 7 deletions(-)

diff --git a/devlog/_plan/260912_devin_hardening/020_cloud_direct_hardening.md b/devlog/_plan/260912_devin_hardening/020_cloud_direct_hardening.md
index 726c5e181e..873b08eb3d 100644
--- a/devlog/_plan/260912_devin_hardening/020_cloud_direct_hardening.md
+++ b/devlog/_plan/260912_devin_hardening/020_cloud_direct_hardening.md
@@ -76,3 +76,18 @@ already knows, with status 499.
 ## Verification
 
 bun test tests/providers/devin-adapter.test.ts tests/providers/devin-hardening.test.ts
+
+## 5. A Connect trailer carries no status — closed
+
+Landed in `connectTrailerHttpStatus`. The three EOS trailer throw sites now pass a status,
+so a cap delivered as `permission_denied` with "your limit will reset" reads as 429 rather
+than 403, an `unauthenticated` trailer reaches the auth path, and an unrecognised code still
+falls back to message inference. `unimplemented` maps to 501 and is explicitly non-retryable,
+because the blanket 5xx rule was telling clients to retry a call the service does not
+implement.
+
+Accepted residuals: `internal`, `unknown` and `data_loss` map to 502 rather than Connect's
+500 — both are transient here and 502 is what this adapter already reported — and a genuine
+ACL denial whose text happens to contain the words "rate limit" would be read as a cap. The
+regex reads the raw trailer message, never the enriched text, so the tool-description
+blocklist wrapper cannot trip it.
diff --git a/src/adapters/devin.ts b/src/adapters/devin.ts
index 5bbd65c480..9260976058 100644
--- a/src/adapters/devin.ts
+++ b/src/adapters/devin.ts
@@ -56,6 +56,10 @@ export function devinErrorClassification(error: unknown): { status?: number; err
   if (status === 401) return { status, errorType: "authentication_error", retryable: false };
   if (status === 403) return { status, errorType: "permission_error", retryable: false };
   if (status === 429) return { status, errorType: "rate_limit_error", retryable: true };
+  // 501 is the one 5xx that will never succeed on a second attempt: the service
+  // does not implement the call. Marking it retryable put `retryable: true` on
+  // the SSE failure a client reads, inviting a retry that cannot change.
+  if (status === 501) return { status, retryable: false };
   if (status >= 500) return { status, retryable: true };
   return { status, retryable: false };
 }
diff --git a/src/adapters/devin/cloud-direct/chat.ts b/src/adapters/devin/cloud-direct/chat.ts
index 2c7b7c32a1..d67a7696e1 100644
--- a/src/adapters/devin/cloud-direct/chat.ts
+++ b/src/adapters/devin/cloud-direct/chat.ts
@@ -969,6 +969,45 @@ export class CloudChatError extends Error {
 
 const TRACE_ID_RE = /\(trace ID: ([0-9a-f]+)\)/i;
 
+/**
+ * A quota refusal Cognition delivers as `permission_denied`.
+ *
+ * "Your limit will reset in 13 minutes" and "Reached overall message rate
+ * limit" are caps, not authorization failures. Classified as 403 they invite
+ * the client to retry straight into a live cap; as 429 the proxy backs off and
+ * can rotate.
+ */
+const TRAILER_QUOTA_RE = /\b(?:limit will reset|rate limit|quota exceeded|out of credits)\b/i;
+
+/**
+ * Connect error code to HTTP status.
+ *
+ * Without this only the HTTP status line reached the adapter, so a cap or an
+ * expired credential delivered as an EOS trailer fell through to
+ * `inferHttpStatusFromAdapterMessage` and became a generic 502 — which is not
+ * retryable-with-backoff, not an auth prompt, and not something core's failover
+ * acts on.
+ */
+export function connectTrailerHttpStatus(code: string | undefined, message: string): number | undefined {
+  if (code === 'permission_denied' && TRAILER_QUOTA_RE.test(message)) return 429;
+  switch (code) {
+    case 'unauthenticated': return 401;
+    case 'permission_denied': return 403;
+    case 'resource_exhausted': return 429;
+    case 'not_found': return 404;
+    case 'unavailable': return 503;
+    case 'deadline_exceeded': return 504;
+    case 'unimplemented': return 501;
+    case 'invalid_argument':
+    case 'failed_precondition':
+    case 'out_of_range': return 400;
+    case 'internal':
+    case 'unknown':
+    case 'data_loss': return 502;
+    default: return undefined;
+  }
+}
+
 /**
  * Stream chat events from the cloud. Yields CloudChatEvent (text deltas, tool
  * call deltas, finish reason). Use `streamChatText` for legacy text-only iteration.
@@ -1085,10 +1124,9 @@ export async function* streamChatEvents(req: CloudChatRequest): AsyncGenerator<C
     // error event and /api/logs, and a Connect error can quote the request that
     // produced it - which is the request holding the api_key.
     //
-    // Only the HTTP status line is carried here. A Connect EOS trailer that
-    // reports resource_exhausted or unavailable still arrives without a status,
-    // so a cap delivered that way keeps the older message-inference path.
-    // Mapping trailer codes onto HTTP statuses is deliberately a follow-up.
+    // The status line is carried on the error. A cap or an expired credential
+    // delivered instead as a Connect EOS trailer is mapped by
+    // connectTrailerHttpStatus at the trailer sites below.
     throw new CloudChatError(`GetChatMessage failed (HTTP ${resp.status})`, undefined, undefined, resp.status);
   }
   if (!resp.body) {
@@ -1316,7 +1354,12 @@ export async function* streamChatEvents(req: CloudChatRequest): AsyncGenerator<C
         `service accepts. If the request is unchanged and this is new, the ` +
         `account's model access is the next thing to check. ` +
         `(cloud trace ID: ${trailerError.traceId ?? 'n/a'})`;
-      throw new CloudChatError(enriched, trailerError.code, trailerError.traceId);
+      throw new CloudChatError(
+        enriched,
+        trailerError.code,
+        trailerError.traceId,
+        connectTrailerHttpStatus(trailerError.code, trailerError.message),
+      );
     }
     // Cognition also returns `permission_denied` when a tool description
     // contains a blocklisted phrase that the sanitizer above did not catch
@@ -1336,9 +1379,19 @@ export async function* streamChatEvents(req: CloudChatRequest): AsyncGenerator<C
         // was a phrase match at all.
         `(cloud message: ${trailerError.message}) ` +
         `(cloud trace ID: ${trailerError.traceId ?? 'n/a'})`;
-      throw new CloudChatError(enriched, trailerError.code, trailerError.traceId);
+      throw new CloudChatError(
+        enriched,
+        trailerError.code,
+        trailerError.traceId,
+        connectTrailerHttpStatus(trailerError.code, trailerError.message),
+      );
     }
-    throw new CloudChatError(trailerError.message, trailerError.code, trailerError.traceId);
+    throw new CloudChatError(
+      trailerError.message,
+      trailerError.code,
+      trailerError.traceId,
+      connectTrailerHttpStatus(trailerError.code, trailerError.message),
+    );
   }
   // Truncation detection: the cloud always terminates a successful stream
   // with an EOS trailer. If we hit `done` from the body reader without one,
diff --git a/tests/providers/devin-hardening.test.ts b/tests/providers/devin-hardening.test.ts
index 4b73c8e20f..6d85a61007 100644
--- a/tests/providers/devin-hardening.test.ts
+++ b/tests/providers/devin-hardening.test.ts
@@ -7,6 +7,7 @@ import { anySignal } from "../../src/lib/abort";
 import { buildGetChatMessageRequestForTests } from "../../src/adapters/devin/cloud-direct/chat";
 import { decodeModelUsageStats } from "../../src/adapters/devin/cloud-direct/chat";
 import { CloudChatError, decodeChatFrame } from "../../src/adapters/devin/cloud-direct/chat";
+import { connectTrailerHttpStatus } from "../../src/adapters/devin/cloud-direct/chat";
 import { devinErrorClassification, mergeDevinUsage } from "../../src/adapters/devin";
 import { iterFields } from "../../src/adapters/devin/cloud-direct/wire";
 import { buildMetadata, normalizeDevinSessionToken } from "../../src/adapters/devin/cloud-direct/metadata";
@@ -398,3 +399,48 @@ describe("devin usage merging and error classification", () => {
     expect(devinErrorClassification(new CloudChatError("x", "resource_exhausted"))).toEqual({});
   });
 });
+
+describe("connect trailer to HTTP status", () => {
+  test("a cap delivered as permission_denied is a 429, not a 403", () => {
+    // Cognition sends the account cap through the same code as an ACL denial.
+    // Classified 403 the client retries straight into a live cap.
+    expect(connectTrailerHttpStatus("permission_denied", "Your limit will reset in 13 minutes")).toBe(429);
+    expect(connectTrailerHttpStatus("permission_denied", "Reached overall message rate limit")).toBe(429);
+    // An ordinary denial stays a denial.
+    expect(connectTrailerHttpStatus("permission_denied", "an internal error occurred")).toBe(403);
+  });
+
+  test("the remaining Connect codes map to the status core acts on", () => {
+    expect(connectTrailerHttpStatus("unauthenticated", "")).toBe(401);
+    expect(connectTrailerHttpStatus("resource_exhausted", "")).toBe(429);
+    expect(connectTrailerHttpStatus("unavailable", "")).toBe(503);
+    expect(connectTrailerHttpStatus("deadline_exceeded", "")).toBe(504);
+    expect(connectTrailerHttpStatus("invalid_argument", "")).toBe(400);
+    expect(connectTrailerHttpStatus("internal", "")).toBe(502);
+    // An unknown code keeps the older message-inference path rather than
+    // asserting a status nobody measured.
+    expect(connectTrailerHttpStatus("some_new_code", "")).toBeUndefined();
+    expect(connectTrailerHttpStatus(undefined, "")).toBeUndefined();
+  });
+
+  test("a trailer status reaches the adapter's structured classification", () => {
+    const err = new CloudChatError("capped", "permission_denied", "abc", connectTrailerHttpStatus("permission_denied", "Your limit will reset in 3 minutes"));
+    expect(devinErrorClassification(err)).toEqual({ status: 429, errorType: "rate_limit_error", retryable: true });
+  });
+});
+
+describe("devin status classification across the newly reachable trailer codes", () => {
+  const cls = (status: number) => devinErrorClassification(new CloudChatError("x", undefined, undefined, status));
+
+  test("a request the service will not accept is never retried", () => {
+    expect(cls(400)).toEqual({ status: 400, retryable: false });
+    expect(cls(404)).toEqual({ status: 404, retryable: false });
+    // 501 is the one 5xx a second attempt cannot change.
+    expect(cls(501)).toEqual({ status: 501, retryable: false });
+  });
+
+  test("a timeout or an unavailable service is retryable", () => {
+    expect(cls(503)).toEqual({ status: 503, retryable: true });
+    expect(cls(504)).toEqual({ status: 504, retryable: true });
+  });
+});