test(devin-cli): anchor the empty-data-dir fallback at the host home

[lidge-jun]

Summary

Carries #4384 (@luvs01, head fdba29bc1ae1cf262430764221312d729476a551) onto the current dev tip.

devinCliCredentialsPath picks path.win32 or path.posix from its platform argument, but the empty-value fallback joins the host homedir(). On a Windows runner, asking about "linux" therefore returns C:\Users\<name>/.local/share/devin/credentials.toml, and the test asserted a leading /:

D:\a\opencodex\opencodex\tests\providers\devin-cli-login.test.ts:155:40
Expected: true
Received: false

Anchor both crossings at the host home instead, normalising through win32.join for the win32 branch so a POSIX host home is compared with matching separators. Anchoring is what actually proves the path is not cwd-relative, which is the defect this test pins; a leading slash only ever held because the host happened to be POSIX.

Production behaviour is unchanged. Test-only.

Verification

• Hosted CI on this exact head is the merge proof. Local product tests, typecheck, build and install were NOT RUN in the authoring session, by explicit instruction.
• Reviewed independently before landing. Confirmed the resolver reads the platform argument at src/oauth/devin-cli.ts:71 while homedir() reflects the host; walked both host/platform crossings; confirmed the untouched endsWith on the next line does not leave a second Windows failure, because the posix branch joins with forward slashes; and confirmed win32.join(homedir()) is a real normalisation rather than a single-argument no-op.
• Noted and accepted: the prefix assertion would be vacuous if homedir() were empty or /. The original cwd-relative defect stays proven by the surviving endsWith assertions and the startsWith("devin") === false check.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Maintainer integration under MAINTAINERS.md: dev only, with exact-head CI evidence recorded before merge.

Supersedes #4384.

Summary by CodeRabbit

• Tests
  • Updated login path coverage to validate credential locations against the current user’s home directory.
  • Added platform-specific checks for Windows and POSIX environments.
  • Improved test reliability across operating systems.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-13T03:26:23.962334Z	460e07c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c1e0c8de-193d-482c-b292-405d2213dc8d

📥 Commits

Reviewing files that changed from the base of the PR and between 096d843 and 460e07c.

📒 Files selected for processing (1)

• tests/providers/devin-cli-login.test.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

The test updates fallback credential-path assertions in tests/providers/devin-cli-login.test.ts. POSIX checks now use homedir(), and win32 checks use win32.join(homedir()).

Changes

Devin CLI path test

Layer / File(s)	Summary
Cross-platform path assertions tests/providers/devin-cli-login.test.ts	Imports homedir and win32. The empty XDG_DATA_HOME/APPDATA test checks the POSIX path against the real home directory and adds a win32 path assertion.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 460e0

This test-only update improves cross-platform fallback-path coverage without changing production behavior, so it is mergeable after normal CI checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: updating the Devin CLI test to anchor the empty-data-directory fallback at the host home directory.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/260913-devin-cli-fixture

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

리뷰 · 우선순위 58 / 80

설명

이 PR은 제품 코드를 바꾸지 않고, Devin CLI 자격 증명 경로 테스트만 고칩니다. 지금 dev 끝(2bd8edf, #4444 Z.AI GLM 예상 비용 오버레이 직후)에도 src/oauth/devin-cli.ts의 devinCliCredentialsPath는 그대로입니다. 플랫폼 인자로 path.win32 / path.posix를 고르지만, XDG_DATA_HOME이나 APPDATA가 비어 있으면 호스트의 homedir()에 붙입니다.

그래서 Windows CI에서 platform="linux"를 물어보면 결과는 C:\Users\…/.local/share/devin/credentials.toml처럼 됩니다. 예전 테스트는 startsWith("/")만 봤기 때문에 호스트가 Windows면 실패했습니다. 이번 변경은 리눅스 교차는 homedir()로, win32 교차는 win32.join(homedir())로 같은 집 디렉터리에 붙는지 확인합니다. cwd에 상대 경로가 되지 않는다는 원래 버그 핀은 endsWith(…credentials.toml)과 startsWith("devin") === false로 그대로 남습니다.

본문은 #4384(@luvs01)를 현재 dev 팁에 다시 올린 유지보수 랜딩입니다. #4384는 아직 열린 초안이라, 이 PR이 합쳐지면 원본은 닫아야 합니다. 프로덕션 동작은 같고 테스트만 바뀌므로, 정확한 헤드 CI만 초록이면 합치기 좋습니다.

참고로 오늘 웨이크는 #4446 머지 알림이었지만, 그 커밋은 이미 이전 dev에 있었고 이번 git pull로 실제로 앞으로 간 것은 #4444(검증된 Z.AI GLM 리스트 가격 오버레이)입니다. 이 리뷰의 기준선도 그 HEAD입니다.

tests/providers/devin-cli-login.test.ts:155 근처 - 예전 startsWith("/")는 Windows 호스트에서 리눅스 플랫폼을 물을 때 깨집니다. 이번 수정이 그 교차 케이스를 맞춥니다.
src/oauth/devin-cli.ts devinCliCredentialsPath - 제품 경로는 그대로입니다. 플랫폼 인자 경로와 호스트 homedir() 폴백이 섞인 설계라 테스트만 호스트 기준으로 맞춰야 합니다.
tests/providers/devin-cli-login.test.ts win32 분기 - win32.join(homedir())로 구분자를 맞추는 건 맞습니다. 단, homedir()가 비거나 /면 접두 검사는 약해질 수 있고, PR도 그걸 인정했습니다. cwd 상대 경로 금지는 endsWith와 startsWith("devin")===false가 지탱합니다.
#4384 - 같은 제목의 원본 PR이 아직 OPEN/draft입니다. #4448이 랜딩이면 Landed via #4448 후 닫아야 열린 PR 수가 부풀지 않습니다.

메인테이너의 판단이 필요한 지점

• 이 헤드의 호스티드 CI만으로 합칠지, 로컬 제품 테스트/타입체크를 한 번 더 돌릴지
• #4384를 test(devin-cli): anchor the empty-data-dir fallback at the host home #4448 랜딩 직후 바로 닫을지(권장), 아니면 CI 통과 후에만 닫을지

너의 추천
정확한 헤드 CI가 초록이면 #4448을 dev에 합치고, 이어서 #4384에 Landed via #4448 at <commit> 남긴 뒤 landed-via-maintainer로 닫으세요. 제품 코드 변경이 없으니 리베이스 대기나 추가 패치는 필요 없습니다.

이 댓글은 grok-bot이 작성했습니다

[lidge-jun]

Maintainer integration into dev under MAINTAINERS.md.

• Exact head merged: 460e07cab0b342a4fb8c0e4f85b747e13e5c9ee1.
• Hosted CI on that exact head: 22 successful checks, 0 failed, 0 cancelled, including the Windows job this change exists to fix.
• Skipped jobs are not counted as passing.
• Local product suite, typecheck, build and install were NOT RUN in the authoring session by explicit instruction; hosted exact-head CI is the sole merge proof.
• Integrated without a second maintainer approval, which the policy permits for dev only. This is maintainer integration, not a self-approval.

Supersedes #4384, whose author is credited by the Co-authored-by trailer on the squashed commit.