feat(devin): support Enterprise personal ACU cycles

[jeanroloff]

Summary

Extends the existing Devin provider with optional support for dedicated Devin Enterprise deployments. When an Enterprise host is configured, CodexBar imports the browser session for that origin and reads the signed-in user's personal monthly ACU cycle. Leaving the field empty preserves existing standard Devin behavior.

Why

Closes #3603

Dedicated Devin Enterprise deployments use a separate host and personal monthly ACU cycle, rather than the organization Daily/Weekly quota shape currently supported by the standard provider.

Implementation

• Adds an optional Enterprise host setting, for example your-team.devinenterprise.com.
• Reuses Devin's existing browser-session discovery and organization matching with credentials bound to the configured origin. This builds on the origin-isolation behavior introduced around fix(devin): isolate browser sessions and honor organization selection #3735 instead of adding a separate authentication mechanism.
• Prefers the appropriate Auth0 token for Enterprise without changing standard Devin's existing auth behavior.
• Calls /api/personal-analytics/usage-limit and maps the monthly cycle to the primary shared UsageSnapshot window, with shared ACU detail rows.
• Uses the real cycle duration when both cycle boundaries are available; when only the end is provided, it does not invent a 30-day duration.
• Adds synthetic tests and documents both standard and Enterprise setup.

Security / privacy

Enterprise support is opt-in. Credentials are scoped to the configured, validated HTTPS origin, and no Enterprise host is contacted while the setting is empty. The provider queries only the signed-in user's personal analytics and does not log tokens. Standard Devin behavior remains unchanged.

Validation

• Focused Devin Enterprise/session tests: PASS (17 tests).
• Full relevant test suite: PASS (1,308 selections across 119 groups).
• make check: PASS (formatting and lint clean).
• swift build -c release: PASS.
• Manual validation against a Devin Enterprise deployment: PASS (user-confirmed).

Opened as a Draft to make the implementation and scope available for concrete review before moving to Ready for Review.

Scope

• No Burn Down widget expansion or generic billing-cycle framework.
• Does not claim to fix No Devin browser session found. Please log in to app.devin.ai or paste a Bearer token. #3660 or No Devin browser session found. Please log in to app.devin.ai or paste a Bearer token. #3781, and does not implement Feature request: support all compatible providers in Burn Down widgets #3097.
• Does not change standard Devin quota behavior.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review blocked

Automated review did not run, so no review verdict was produced.

Reason: The input-safety check rejected material in this revision. No detected value, path, or scanner output is reproduced here.

ClawSweeper will not retry this unchanged revision.

Next step: If this is a genuine credential, remove and rotate it. If it is an intentional test fixture, a maintainer must review and qualify it.

View the workflow run.