"note": "Heuristic false-green LEADS, not findings. A finding requires a demonstrated reproduction (surviving mutation via mutation-runner). Do not treat a candidate as a confirmed false green. Coverage-theater leads may include tests that delegate their assertion to a custom helper the classifier does not recognise; verify before acting.",

  "sourceDigest": "sha256:dd810dd48c5bdbc9becd7fcc01dd41a4ca2abf0b2d6f6a545907247f6e3e8361",

  "summary": {

    "filesScanned": 2435,

    "filesScanned": 2436,

    "candidateCount": 16,

    "byMode": {

      "false_green_coverage_theater": 15,

{

  "schemaVersion": "1",

  "repository": "OpenAgentsInc/openagents",

  "sourceDigest": "sha256:df1ae247646ce2032b886c6ad9a2641425b70af96750dec46faa193b2ac1cba6",

  "sourceDigest": "sha256:213d97f4fd62f412e9feabce849ebb61ba854f8faad1fd31941e0f8ec982cc63",

  "surfaces": [

    {

      "id": "app:@openagentsinc/acceptance-runner",

      "oracles": [

        {

          "type": "test",

          "ref": "packages/openagents-cli (35 tracked test files)"

          "ref": "packages/openagents-cli (36 tracked test files)"

        },

        {

          "type": "behavior-contract",

prompt and is told its own number separately — write for whichever child is

reading, rather than naming one.

## The Devin CLI, for a whole task

## `delegate --child-model devin`, for a Devin fan-out

If `devin` is on `PATH`, `delegate` can run its children on it instead of on

opencode: pass `--child-model devin`, or `devin:<mode>` for a permission mode

other than the default `dangerous`.

Prefer this over running `devin` yourself through `shell`. A child started this

way is a fleet child like any other — it reports through the registry the

interface renders, it can be stopped with `ctrl+x`, it does not block the turn

that started it, and several run at once. Run through `shell`, the same work is

one call that freezes the session and shows nothing until it ends.

A Devin child brings its own credentials and its own model rather than spending

this session's grant, which is a different trust and billing boundary from an

opencode child. That is why the fleet names the agent.

Its print mode has no structured output, so a Devin child reports its answer

once at the end rather than streaming its tool calls the way an opencode child

does.

## The Devin CLI directly, for one task you will wait on

If `devin` is on `PATH`, it is another coding agent on this machine, and it can

take a task end to end rather than one prompt in parallel. Check with

rejected — it is accepted and ignored, so the session silently falls back to

prompting, and a prompt nobody can answer is a task that does nothing.

**It refuses a workspace it does not trust**, but only in a directory nobody has

opened it in. You will know because it exits at once, before doing anything,

with the words `Refusing to run in an untrusted workspace`. Only that message

means this; do not read any other failure as a trust problem. Trust is granted

by starting `devin` interactively there once, which only the person at the

keyboard can do, so say so and name the directory rather than working around it.

`respect_workspace_trust` is a config-file key, not a command-line flag, and

passing it as one will not do anything.

**It refuses a workspace nobody has opened it in**, exiting at once with

`Refusing to run in an untrusted workspace`. Print mode cannot show the trust

prompt, so it fails rather than asking. Pass `--respect-workspace-trust false`

to skip the check, which is what print mode is for; the alternative is someone

starting `devin` interactively in that directory once. Only that exact message

means trust — do not read other failures as a trust problem.

**`dangerous` auto-approves every tool it has.** That is the point of using it

unattended, and it is the reason to say what you are handing over before you

import { startChildGateway } from "./coder-child-gateway.js";

import { writeChildHarnessConfig } from "./coder-child-config.js";

import type { DelegationOutcome } from "./coder-delegate.js";

import { DelegateFleet, describePrompt, OpencodeHarness } from "./coder-delegate.js";

import { DelegateFleet, DevinHarness, describePrompt, OpencodeHarness } from "./coder-delegate.js";

import { fleetPlainLines } from "./coder-fleet.js";

import { runCoderPlain } from "./coder-plain.js";

import type { CoderDelegation } from "./coder-session.js";

  const command = options.command ?? process.env["OPENAGENTS_DELEGATE_COMMAND"];

  const namedConfig = options.configPath ?? process.env["OPENAGENTS_DELEGATE_CONFIG"];

  // `--child-model devin` runs children on the Devin CLI instead. It brings its

  // own credentials and its own model, so it needs neither this session's grant

  // nor a gateway, and it is refused up front when it is not installed rather

  // than once per child.

  if (named !== undefined && /^devin(:(.+))?$/.test(named.trim())) {

    const mode = /^devin:(.+)$/.exec(named.trim())?.[1];

    const harness = new DevinHarness(mode === undefined ? {} : { permissionMode: mode });

    const registry = new CoderTaskRegistry();

    const fleet = new DelegateFleet(registry, harness, {

      maxConcurrent: Math.max(1, options.concurrency),

      cwd: options.cwd,

    });

    return {

      delegation: { registry, fleet, label: `${harness.agent} (${harness.model})` },

      close: () => Promise.resolve(),

    };

  }

  let model: string;

  let configPath: string | undefined;

  let close: () => Promise<void>;

}

/** Runs children as `opencode run --format json` subprocesses. */

/** How a Devin child is run. */

export interface DevinHarnessOptions {

  /** The binary, so a test can point at a stand-in. Defaults to `devin`. */

  readonly command?: string | undefined;

  /**

   * The permission mode passed through.

   *

   * `dangerous` is this build's name for the unattended mode -- the published

   * documentation calls it "bypass", and passing that is accepted and ignored,

   * so a child would silently fall back to prompting where nobody can answer.

   */

  readonly permissionMode?: string | undefined;

  /** Extra environment for the child. */

  readonly env?: Record<string, string> | undefined;

}

/**

 * Children run by the Devin CLI.

 *

 * A second harness rather than a shell command, so a Devin fan-out is a fleet

 * like any other: it reports through the registry the renderer reads, it can be

 * stopped with the rest, and it does not block the turn that started it. Run

 * through `shell` instead, the same work is one opaque call that freezes the

 * session and shows nothing while it runs.

 *

 * Devin's print mode has no structured output, so a child reports its answer

 * once at the end rather than streaming tool calls the way `opencode --format

 * json` does. The fleet still shows it start, run, and finish, which is the

 * part the reader is waiting on.

 *

 * Its own credentials are used, not this session's grant. That is a different

 * trust and billing boundary from an `opencode` child, and it is the reason the

 * agent is named in the fleet rather than left implicit.

 */

export class DevinHarness implements DelegateHarness {

  readonly agent = "devin";

  readonly model: string;

  constructor(private readonly options: DevinHarnessOptions = {}) {

    // Devin picks its own model from its own configuration, and print mode does

    // not report which. Naming one here would be inventing it.

    this.model = options.permissionMode ?? "dangerous";

  }

  async *run(

    input: { readonly prompt: string; readonly cwd: string; readonly transcriptPath: string },

    signal: AbortSignal,

  ): AsyncIterable<DelegateEvent> {

    const command = this.options.command ?? "devin";

    const mode = this.options.permissionMode ?? "dangerous";

    const child = spawn(

      command,

      [

        "-p",

        input.prompt,

        "--permission-mode",

        mode,

        // Print mode cannot show the trust prompt, so without this a child in a

        // directory nobody has opened Devin in exits before doing anything.

        "--respect-workspace-trust",

        "false",

      ],

      {

        cwd: input.cwd,

        env: { ...process.env, ...this.options.env },

        // No terminal: a child that would prompt gets end-of-file and stops

        // rather than waiting where the fleet shows it as still working.

        stdio: ["ignore", "pipe", "pipe"],

      },

    );

    const events: DelegateEvent[] = [];

    let resolveNext: (() => void) | undefined;

    const wake = () => {

      resolveNext?.();

      resolveNext = undefined;

    };

    let answer = "";

    let failure = "";

    let done = false;

    let startFailure: Error | undefined;

    child.stdout.setEncoding("utf8");

    child.stdout.on("data", (chunk: string) => {

      answer += chunk;

    });

    child.stderr.setEncoding("utf8");

    child.stderr.on("data", (chunk: string) => {

      failure += chunk;

    });

    const onAbort = () => child.kill("SIGKILL");

    signal.addEventListener("abort", onAbort, { once: true });

    child.on("error", (cause: Error) => {

      startFailure =

        (cause as NodeJS.ErrnoException).code === "ENOENT"

          ? new Error(`The \`${command}\` command is not on PATH.`)

          : cause;

      done = true;

      wake();

    });

    child.on("close", (code: number | null) => {

      const text = answer.trim();

      if (code === 0) {

        if (text.length > 0) events.push({ type: "text", value: text });

      } else {

        const said = `${failure.trim()}\n${text}`.trim();

        events.push({

          type: "error",

          message:

            said.length > 0

              ? said

              : `The \`${command}\` child exited with code ${String(code ?? -1)}.`,

        });

      }

      done = true;

      wake();

    });

    try {

      for (;;) {

        while (events.length > 0) {

          const next = events.shift();

          if (next !== undefined) yield next;

        }

        if (done) break;

        await new Promise<void>((resolve) => {

          resolveNext = resolve;

        });

      }

    } finally {

      signal.removeEventListener("abort", onAbort);

    }

    if (startFailure !== undefined) throw startFailure;

  }

}

export class OpencodeHarness implements DelegateHarness {

  readonly agent = "opencode";

  readonly model: string;

import { chmodSync, mkdtempSync, writeFileSync } from "node:fs";

import { tmpdir } from "node:os";

import { join } from "node:path";

import { describe, expect, it } from "vitest";

import { DevinHarness, type DelegateEvent } from "../src/coder-delegate.js";

/** A stand-in for the binary, so the tests cost nothing and never call out. */

const fake = (script: string): string => {

  const directory = mkdtempSync(join(tmpdir(), "devin-harness-"));

  const path = join(directory, "devin-stub");

  writeFileSync(path, `#!/bin/sh\n${script}\n`);

  chmodSync(path, 0o755);

  return path;

};

const collect = async (

  harness: DevinHarness,

  cwd = process.cwd(),

): Promise<ReadonlyArray<DelegateEvent>> => {

  const events: DelegateEvent[] = [];

  for await (const event of harness.run(

    { prompt: "do the thing", cwd, transcriptPath: join(tmpdir(), "unused.jsonl") },

    new AbortController().signal,

  )) {

    events.push(event);

  }

  return events;

};

describe("running children on the Devin CLI", () => {

  it("names itself in the fleet, so a Devin child is not mistaken for an opencode one", () => {

    // Its credentials and its billing are not this session's, which is why the

    // agent is named rather than left implicit.

    expect(new DevinHarness().agent).toBe("devin");

  });

  it("reports the child's answer as text", async () => {

    const events = await collect(new DevinHarness({ command: fake('echo "PONG"') }));

    expect(events).toEqual([{ type: "text", value: "PONG" }]);

  });

  it("passes the prompt, the unattended mode, and the trust flag", async () => {

    // Print mode cannot show the trust prompt, so without the flag a child in a

    // directory nobody has opened Devin in exits before doing anything.

    const events = await collect(new DevinHarness({ command: fake('echo "$@"') }));

    const said = (events[0] as { value: string }).value;

    expect(said).toContain("-p do the thing");

    expect(said).toContain("--permission-mode dangerous");

    expect(said).toContain("--respect-workspace-trust false");

  });

  it("takes a different permission mode when one is asked for", async () => {

    const harness = new DevinHarness({ command: fake('echo "$@"'), permissionMode: "auto" });

    const said = ((await collect(harness))[0] as { value: string }).value;

    expect(said).toContain("--permission-mode auto");

    // The mode is what the fleet shows beside the agent, because print mode

    // does not report which model answered.

    expect(harness.model).toBe("auto");

  });

  it("reports a failing child as an error, with what it said", async () => {

    const events = await collect(

      new DevinHarness({ command: fake('echo "went wrong" >&2; exit 2') }),

    );

    expect(events).toEqual([{ type: "error", message: "went wrong" }]);

  });

  it("says so when a failing child said nothing at all", async () => {

    const events = await collect(new DevinHarness({ command: fake("exit 3") }));

    expect((events[0] as { message: string }).message).toContain("exited with code 3");

  });

  it("throws when the binary is not on PATH, rather than reporting an empty child", async () => {

    // Refused once for the fleet, not once per child.

    await expect(collect(new DevinHarness({ command: "devin-does-not-exist" }))).rejects.toThrow(

      "not on PATH",

    );

  });

  it("stops when the fleet is stopped", async () => {

    const harness = new DevinHarness({ command: fake("sleep 30") });

    const controller = new AbortController();

    const events: DelegateEvent[] = [];

    const running = (async () => {

      for await (const event of harness.run(

        { prompt: "x", cwd: process.cwd(), transcriptPath: "/tmp/x" },

        controller.signal,

      )) {

        events.push(event);

      }

    })();

    controller.abort();

    await running;

    // Killed rather than left running: a child holds a process, and a console

    // that exits while children keep spending leaves nothing to stop them with.

    expect(events.every((event) => event.type !== "text")).toBe(true);

  });

});