[okisdev]

summary

• new devin companion plugin drives the Devin CLI over the agent client protocol (devin acp): diversity consults on any family a Devin plan serves (kimi, glm, gemini, muse, deepseek, ...) and burst implementation on Cognition's SWE models. cursor's october pricing change moved third party models off its included plans, which emptied cursor's diversity seat for accounts on them
• isolation per the new docs/devin-contract.md: a shared private home that links only the credentials file, a per job XDG_CONFIG_HOME whose config turns off every import except AGENTS.md, Read(...) deny rules for credential and agent config directories, every session/request_permission refused, a tool allowlist checked on each tool_call, the OS sandbox for writes, and model, thought level, and standard speed pinned through session config options. adaptive and fusion-* routers are refused and hidden from models --json
• exactly one breadth engine holds the routing seat: /fusion:config set-breadth <cursor|devin> (default cursor) writes a top level breadth key, the rendered table shows only that engine's rows plus a breadth sentence, and the other engine still works for direct commands, collection, stats, and breakers. engine literals in config, stats, pruning, and dispatch are now registry driven
• rules, panel, ultra, smoke, doctor, config, README, SECURITY, and CONTRIBUTING speak of the breadth engine instead of cursor
• fix: /fusion:stats --record settles a codex collector task again. the stop hook asked for that command, but the collector guard refused both the task id and the job id, so the block repeated until it released on its own
• release 0.0.68: versions bumped together, changelog entry, rules-manifest.json regenerated. plugins/devin/scripts/lib/{args,process-identity,raw-transport,record-lock}.mjs are vendored by shared/sync.mjs; the reviewable logic is in devin-exec.mjs, devin-home.mjs, devin-models.mjs, and devin-companion.mjs

test plan

already verified

• npm test -> 1781 tests, 1778 pass, 0 fail, 3 skipped
• claude plugin validate on plugins/codex, plugins/grok, plugins/cursor, plugins/devin, plugins/fusion, and . -> all passed
• live against devin 3000.11.228 on a Devin Pro account: setup reports ready with plan tier; a consult on kimi-k3 --effort high returns with observedModel "Kimi K3 High" and reported usage; a --write job on swe-2 creates its file while echo > /tmp/... fails inside the sandbox; --resume <session> answers from the earlier turn without replayed text; a consult asking for web_search ends as failure: policy
• the live run caught two fake CLI mismatches, both fixed with tests: session/load returns no sessionId, and the observed model label carries the effort suffix

reviewer should verify

• after the marketplace update, /fusion:config set-breadth devin then /fusion:setup renders a table with devin rows and the breadth sentence, and an automatic diversity brief goes to devin:devin-rescue
• /fusion:smoke passes its breadth gate with devin selected

notes

• rules edits, per CONTRIBUTING's checklist: every cursor specific sentence becomes a breadth engine sentence naming cursor and devin; the protected roles, the router ban (now also devin adaptive and fusion pairings), the family substitution rule, and billing pool scoping keep their meaning. no invariant is softened