[screen-gd]

Problem

Devin is available as an ACP Registry provider, but Usage shows neither its remaining subscription allowance nor its token use and cost. ACP exposes neither.

Change

Limits. Read the remaining daily and weekly allowance and reset times from GetUserStatus using the Devin CLI's login, including Windows AppData. Plans that hide daily quota show only the weekly allowance, and the same account counts once across environments. Disabled Devin instances read no credentials and make no quota request. The quota request refuses redirects, so the API key in its body can't be sent anywhere but the API server. Missing credentials, unsupported billing, and failed requests show as unavailable.

Cost and Tokens. Read Devin CLI's saved session history into the same token and cost tracker the other providers use. Both models in Fusion sessions count. Costs use the model prices the installed Devin CLI reports. Models with no known price still add tokens and show as unpriced. A large first scan can take minutes, so totals appear as sessions finish. Completed sessions are saved during the scan, so refreshes and restarts read only new messages.

AcpRegistryDriver (agentId: devin)
  usage: devinUsageReader      # session history -> UsageRecords (new)
  checkUsageLimits             # GetUserStatus -> quota bars
UsageService
  merges Devin records, prices via the Devin model rates
Usage page (web, desktop, mobile)
  "devin" provider: name, logo, model filter

Scope and approval

This adds usage reporting for the existing Devin provider. The Devin team has given the author the go-ahead for the integration. No T3 maintainer approval link has been provided yet.

Related and overlapping work, for comparison:

• fix(usage): show Devin in subscription Limits #26381 adds a Devin dashboard link. This PR fills the existing quota bars and cost charts instead.
• feat(usage): count Devin history from its local sessions database #29631 also adds Devin Cost and Tokens from the local sessions database.
• feat(usage): show Devin's daily and weekly allowance in Limits realhasanshoaib/t3code#1, stacked on fix(usage): show Devin in subscription Limits #26381, adds Devin Limits.

Verification

• Windows desktop, real Devin account: Limits shows 63% weekly remaining with the Devin logo and reset countdown. Cost shows 139 Devin sessions, 5.15B tokens, alongside the other providers. No paid agent turn was run.
• Restart after the first scan: the Devin history read took 0.23 s and reread 0 messages.
• Tests: the quota-reader tests cover Windows AppData, the removed dashboard row, out-of-range reset timestamps, icon retention during account dedup, and the quota request refusing redirects (that assertion fails with the setting removed). New devinUsage.test.ts covers the history reader. UsageService.test.ts and serverUsage.test.ts cover the merge and progressive totals.
• vp run check:changed on ec44e4e's tree passed format, lint, knip, typecheck (36 packages), tests (17 files) and the React Compiler check.
• macOS: @vxirau reports the same GetUserStatus request returns correct daily and weekly values with a real Devin Pro account (Devin CLI 3000.11.228).
• Native mobile and Linux live accounts were not exercised. Mobile adds the Devin provider entry on the shared contract.

Before: Devin usage is absent	After: Devin subscription limits	After: Devin cost and tokens

Reviewed with sol-loop: 2 rounds with GPT-6.1 Sol. Sol verdict: approved

Initial quota implementation by Devin (model not recorded). Windows, UI and Devin token-usage work by GPT-6.1 Sol in Codex through T3 Code. Review fixes, the mobile colour fix and the redirect block by Claude Opus 5.5 in Devin through T3 Code. Sol review loop and PR update by Claude Opus 5.5 in Claude Code through T3 Code.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — Devin accounts gain automatic authenticated quota retrieval and daily/weekly usage displays. Human review is needed for this default behavior change, particularly the reported credential-backed requests from disabled instances.

Needs human approval because:

• 1 blocking correctness issue found at or above your repo's Minimum Blocking Severity

^{Adjust the Minimum Blocking Severity for this repo — including turning it Off — in Settings. You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 9b19a86
• Latest commit, not reviewed: ecdd973

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• Resume reviews
• Trigger review

No actionable comments were generated in the recent review.

Walkthrough

The changes add Devin usage-history scanning, model pricing, and allowance checks. They update provider-rate handling, client refresh behavior, and web and mobile usage displays. Limits pools can show account names and icons, and the usage documentation describes Devin support.

Changes: Devin usage and display

Layer / File(s)	Summary
Devin history reader and cache packages/provider-acp-registry/src/server/devinUsage.ts, packages/provider-acp-registry/src/server/devinUsage.test.ts	The reader scans Devin session databases, parses CLI model prices, assembles usage records, and manages persisted caches and scan refreshes. Tests cover history, caching, pricing, and read errors.
Usage contracts, pricing, and server wiring packages/provider-core/src/server/usage.ts, apps/server/src/usage/*, apps/server/src/server.ts, apps/server/src/provider/builtInDrivers.ts, apps/server/src/usage/UsageService.test.ts	Provider scans can include model-specific rates. The usage service overlays provider rates on shared rates, and the server registers Devin usage services. A service test checks Devin totals and price overrides.
Devin allowance lookup and driver integration packages/provider-acp-registry/src/server/devinUsageLimits.ts, packages/provider-acp-registry/src/server/devinUsageLimits.test.ts, packages/provider-acp-registry/src/server/driver.ts	The allowance reader loads Devin credentials and queries the seat-management API. The driver applies returned limits to eligible registry-backed Devin providers. Tests cover credential selection, quota responses, and unsupported cases.
Usage refresh completion packages/client-runtime/src/state/server.ts, packages/client-runtime/src/state/serverUsage.test.ts	The client requests further summaries while a usage source is refreshing. It emits interim summaries and stops when sources finish refreshing or a refresh request fails.
Provider labels, account icons, and documentation packages/contracts/src/usage.ts, apps/mobile/src/features/usage/usageProviders.ts, apps/web/src/components/usage/*, packages/shared/src/usageLimits.ts, packages/shared/src/usageLimits.test.ts, docs/user/usage.md	The usage interfaces add Devin labels, chart and provider presentation, and loading feedback. Account records carry and merge icon URLs. The documentation describes Devin history, pricing, filtering, and allowances.

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant UsageClient
  participant UsageService
  participant DevinUsageReader
  participant DevinUsage
  participant SessionDatabase
  UsageClient->>UsageService: Request usage summary
  UsageService->>DevinUsageReader: Scan Devin usage source
  DevinUsageReader->>DevinUsage: Request history and model rates
  DevinUsage->>SessionDatabase: Read session and message usage
  SessionDatabase-->>DevinUsage: Return session rows
  DevinUsage-->>DevinUsageReader: Return records, rates, and scan status
  DevinUsageReader-->>UsageService: Provide usage records and rates
  UsageService-->>UsageClient: Return summary and refresh status

Loading

Possibly related issues

• pingdotgg/t3code#28124: The usage changes add Devin provider mapping but do not update the mobile limits call site that omits the account icon URL, so the described icon issue remains unresolved for those rows.

Possibly related PRs

• pingdotgg/t3code#26381: This PR adds credential-based Devin quota reads to the existing Devin Limits entry.
• pingdotgg/t3code#26728: This PR uses ACP Registry account names and icons in pool headings.
• pingdotgg/t3code#29631: This PR extends Devin session-database usage history with caching, model-rate discovery, and quota checks.

Suggested reviewers: maria-rcks, yash-singh1, juliusmarminge

Merge Risk: Moderate · previous review 9b19a

Usage refreshes may issue repeated follow-up requests, and Devin Fusion usage can be undercounted in affected sessions. These risks should be addressed before merge.

Pre-merge checks: 3 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description covers the Problem, Change, Scope and approval, and Verification sections. The Problem and Change sections are clear. Scope and approval is incomplete: the author states the Devin team…	Add a link to the triaged bug issue or to a discussion where a T3 maintainer explicitly approved the direction and scope, including the approval comment. The current text says 'No T3 maintainer approval link has been provided yet,' so this …

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: adding Devin subscription limits, token usage, and cost reporting.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description covers the Problem, Change, Scope and approval, and Verification sections. The Problem and Change sections are clear. Scope and approval is incomplete: the author states the Devin team gave the go-ahead, but no T3 maintainer approval link or comment is provided, and the template requires one for a feature of this size. Verification is substantive, with Windows desktop results, test coverage, a macOS report from another contributor, and before/after screenshots. The Verification section also says native mobile and Linux live accounts were not exercised, which the template asks for. The description also includes an AI-agent attribution line, which the template asks for. The remaining gap is the missing maintainer approval.

Resolution

Add a link to the triaged bug issue or to a discussion where a T3 maintainer explicitly approved the direction and scope, including the approval comment. The current text says 'No T3 maintainer approval link has been provided yet,' so this link is required. Keep the existing Verification section, which already lists what was not checked.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: e27e12d
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2e5ea5ef-9f32-4776-8749-417981687ae6

Commits

Reviewing files that changed from the base of the PR and between b011ee9 and 9b19a86.

Files selected for processing: 1

• apps/mobile/src/features/usage/usageProviders.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

[coderabbitai]

• Fix comments: Fix CodeRabbit comments on this PR

[screen-gd]

Note

🤖 GPT-6.1 Sol responding on behalf of screen-gd

Rebased onto main at e27e12d9b4a4 and pushed 35d0acb690 with an explicit force-with-lease.

The conflict was in packages/provider-acp-registry/src/server/driver.ts: upstream added Effect's Digest service while this PR added HttpClient. Both requirements are retained. The Devin quota reader now uses Digest.sha256, and its tests explicitly provide NodeCrypto.layer, matching upstream's Effect 4.1.2 migration.

The commit-range comparison preserves the quota reporting, Windows credential path, Devin logo, and removal of the redundant dashboard row.

Validation: vp run check:changed e27e12d9b4a408496be359e3e0db1844c6ea87af passed formatting, lint, both unused-code checks, all 34 affected-package typechecks, and 78 tests. The separate quota-reader run passed all seven tests, including the unchanged credential fingerprint. A live reader request still reported 63% weekly remaining with no dashboard row. The React Compiler check's tests were skipped, so compiler coverage is not claimed. The app was not launched.

[maria-rcks]

Note

Written by gpt-6.1-sol on behalf of Maria

Verified in a real dev environment

partial verification of head 35d0acb6902529e7965ca5f941c6fd4ebff7c3ad on a linux vm, using the repo's playwright and /usr/bin/google-chrome at 1440×1000. no source changes.

started github/main (3d369d55968b) in a separate worktree first, then stopped it before starting the exact pr head. used isolated state, added /home/user/t3code as a project through the app, installed devin from the live acp registry (3000.11.234), and ran real codex gpt-6.1-sol turns through the web client and local proxy on both revisions.

the real server-config subscription showed this difference for the installed, enabled devin provider:

main: installed=true, status=ready, usageLimits=null
pr:   installed=true, status=ready,
      usageLimits.windows=[],
      usageLimits.unavailable={reason:"unsupported",
        message:"Sign in to Devin to see usage limits."}

this verifies the new reader's missing-credentials path through the running server and client. limits refresh completed without quota bars. continuing the existing codex thread completed successfully on the pr; switching between tokens and limits also worked. codex quota retrieval reported JSON-RPC -32600 on both main and the pr through this proxy, so that error is a baseline limitation.

matching installed-but-signed-out limits captures follow. neither image proves authenticated devin bars.

focused existing quota-reader, acp-driver, and shared-limits tests passed on blacksmith: 76 tests across three files. vp run check:changed e27e12d9b4a408496be359e3e0db1844c6ea87af also passed all stages, including 78 tests across five files and the changed-file react compiler check, after installing the worker's missing browser dependency.

Not verified

this vm has no devin login. successful authenticated quota retrieval, daily/weekly percentages, hidden-daily plans, reset countdowns, account deduplication, and external api failures remain unverified through a real account. this is not end-to-end proof of the main feature or a merge recommendation.

native mobile, electron shell, windows appdata, macos credentials, and multi-environment behavior were not exercised. no mocks, fabricated credentials, fixtures, or replay-provider turns were used.

[screen-gd]

Note

🤖 Devin (Claude Opus 5.5) responding on behalf of screen-gd

@maria-rcks thanks for the run. Pushed 108d0d5 with three review fixes. None changes the signed-out path you verified:

• Disabled Devin makes no requests. driver.ts now starts the quota read only for enabled instances. Before, a disabled instance still read credentials.toml and sent its key to GetUserStatus, then dropped the result.
• Out-of-range reset timestamps no longer break refresh. resetAtIso uses the non-throwing DateTime.make, so a bad value shows the bar without a reset time. Before, it raised a defect that stopped the provider check on every refresh. Covered by a new row in devinUsageLimits.test.ts.
• Account dedup keeps the icon. collectLimitAccounts now takes iconUrl from either environment. Covered by an extra assertion in the existing dedup test.

vp run check:changed passed on this head (format, lint, knip, typecheck of 34 packages, 79 tests).

Your "not verified" list still stands: the signed-in quota bars, hidden-daily plans, reset countdowns, cross-environment dedup with a real account, and native/desktop/Windows/macOS paths have not been exercised end to end on this head.

[coderabbitai]

• Fix comments: Fix CodeRabbit comments on this PR

[screen-gd]

Note

🤖 Claude Opus 5.5 responding on behalf of screen-gd

Pushed b011ee9: Devin now appears in Usage's Cost and Tokens views, not only Limits.

• packages/provider-acp-registry/src/server/devinUsage.ts reads Devin CLI session history (Fusion sessions count both models) and prices it with the Devin CLI's model rates. Unknown models count tokens and show as unpriced.
• Totals appear as sessions finish. Progress is saved, so a restart after the first scan reread 0 messages in 0.23 s on a 139-session history.
• devin added to UsageProviderKind, web and mobile provider lists, the model filter and docs/user/usage.md.

Checks on this tree: vp run check:changed passed format, lint, knip, typecheck (36 packages), tests (12 files) and the React Compiler check. Two GPT-6.1 Sol review rounds approved with no findings. Still not exercised: native mobile, and live Linux/macOS accounts.

[coderabbitai]

• Fix comments: Fix CodeRabbit comments on this PR

[coderabbitai]

• Fix comments: Fix CodeRabbit comments on this PR

[vxirau]

Glad to see this, I'd love Devin in Usage too. For whoever reviews: this overlaps with realhasanshoaib#1 (Devin Limits, stacked on #26381) and #29631 (Devin Cost and Tokens), in case it helps to compare them.

One small thing worth checking: the GetUserStatus request carries the CLI's API key in the body, so it's worth disabling redirects on it (FetchHttpClient.RequestInit with redirect: "error", like Cursor's accountUsage.ts). That way the key can't be forwarded off server.codeium.com.

I tested the same endpoint on macOS with a real Devin Pro account (CLI 3000.11.228), and the daily and weekly values came back correctly, if that helps with the macOS gap in the verification.

[screen-gd]

Note

🤖 Claude Opus 5.5 responding on behalf of screen-gd

@vxirau good catch. Pushed ec44e4e, so the Devin quota request now refuses redirects.

• packages/provider-acp-registry/src/server/devinUsageLimits.ts provides FetchHttpClient.RequestInit with redirect: "error" on the GetUserStatus call, the same way Cursor's accountUsage.ts does. A redirect now fails the request, and the reader reports "Could not read Devin usage limits." instead of resending the API key to the new location.
• devinUsageLimits.test.ts checks that the request carries redirect: "error". All three quota cases fail when the setting is removed.
• vp run check:changed passed on the pushed tree: format, lint, knip, typecheck (36 packages), tests (17 files), React Compiler.

Thanks for the macOS run with a Pro account. I've added it to the description's Verification section, and listed #29631 and realhasanshoaib#1 there as overlapping work for reviewers to compare. Native mobile and Linux live accounts are still unverified.