fix: read Windsurf Devin session from app origin by kiranmagic7 · Pull Request #1579 · steipete/CodexBar

kiranmagic7 · 2026-06-16T11:30:48Z

Summary

Read complete Windsurf-compatible sessions from https://app.devin.ai before the legacy https://windsurf.com origin.
Keep structured origins isolated so partial app-origin values cannot contaminate a complete legacy session.
Preserve the raw LevelDB text scan as a separate final fallback candidate.
Update runtime guidance and provider docs for both origins.

Proof

Exact rebased head: 54e83c212e520682202f95e8e18cf89734a61d9a
swift test --filter 'WindsurfDevinSessionImporterTests|WindsurfWebFetcherTests' (18 tests passed)
make check
autoreview --mode uncommitted (clean, confidence 0.82)
Live Chrome/account flow: authenticated through app.devin.ai, followed its Devin Desktop View usage SSO handoff, and confirmed all four required fields were present at windsurf.com without reading their values.
Exact-head CLI returned windsurf-web, plan present, daily and weekly windows present, no error.

Scope note

The current live app.devin.ai account had no devin_session_token, devin_auth1_token, devin_account_id, or devin_primary_org_id localStorage keys. The new-origin path is fixture-covered but could not be live-proved with this account. This PR is additive compatibility and references, but does not by itself close, #1564.

Refs #1564

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d15b576522

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-06-16T11:36:20Z

-        for entry in entries where Self.targetKeys.contains(entry.key) {
-            storage[entry.key] = self.decodedStorageValue(entry.value)
-        }
+            for entry in entries where storage[entry.key] == nil && Self.targetKeys.contains(entry.key) {


Keep each origin's session bundle separate

When the first origin has only some of the devin_* keys, this loop preserves those values and fills the missing keys from the next origin because storage is shared across origins and existing keys are skipped. In a profile with stale/incomplete app.devin.ai data but a complete legacy windsurf.com bundle, this constructs a mixed session that the API can reject, and the valid windsurf.com bundle from the same profile is never tried as its own candidate.

Useful? React with 👍 / 👎.

clawsweeper · 2026-06-16T11:49:57Z

Codex review: needs real behavior proof before merge. Reviewed June 18, 2026, 9:54 AM ET / 13:54 UTC.

Summary
The branch reads complete Windsurf-compatible localStorage sessions from app.devin.ai before windsurf.com, keeps structured origins isolated, preserves raw text fallback, and updates tests/docs.

Reproducibility: yes. from source inspection: the PR can produce multiple complete origin snapshots and then discard later same-token candidates before retry. I did not run live provider probes because AGENTS.md cautions against live account/browser-cookie validation unless explicitly requested.

Review metrics: 2 noteworthy metrics.

Changed Surface: 269 additions, 21 deletions across 6 files. Most of the diff is tests, but the implementation changes provider auth candidate ordering and fallback behavior.
Provider Auth Surface: 2 implementation files, 2 test files, 1 doc, 1 changelog. The touched surface is bounded to Windsurf session import/fetch behavior plus focused coverage and documentation.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦐 gold shrimp
Patch quality: 🦐 gold shrimp
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Preserve distinct same-token auth bundles or prove they cannot differ for this API.
[P1] Add real behavior proof from a profile where app.devin.ai contains the complete session bundle, with private values redacted.

Proof guidance:

[P1] Needs stronger real behavior proof before merge: The PR body has exact-head tests and legacy-path live output, but needs redacted screenshot, terminal, log, or copied live output from a profile where app.devin.ai contains the complete session bundle; after updating the PR body, ClawSweeper should re-review automatically or a maintainer can comment @clawsweeper re-review.

Risk before merge

[P2] A same-token app-origin session bundle can still suppress a valid legacy-origin fallback because de-duplication keeps only the first devin_session_token candidate.
[P1] The new app.devin.ai localStorage path has fixture coverage, but not live account proof; the PR body only proves the legacy SSO handoff path with the available account.

Maintainer options:

Preserve Full Auth Candidates (recommended)
Change de-duplication to key on the full Windsurf auth bundle, or otherwise keep distinct same-token source/header bundles retryable after 401/403 responses.
Accept Token-Only De-Dupe
A maintainer could intentionally accept the risk only if they confirm same-token bundles are interchangeable for the Windsurf GetPlanStatus API.

Next step before merge

[P1] The PR needs a contributor or maintainer update for the same-token auth-bundle retry behavior plus live app-origin proof; ClawSweeper cannot supply the contributor's account proof.

Security
Cleared: The diff changes local browser storage parsing, provider tests, docs, and changelog only; I found no new dependency, secret-permission broadening, or supply-chain execution path.

Review findings

[P2] Keep same-token auth bundles retryable — Sources/CodexBarCore/Providers/Windsurf/WindsurfDevinSessionImporter.swift:184

Review details

Best possible solution:

Keep the per-origin import approach, but preserve distinct full Windsurf auth bundles through retry ordering and add redacted app-origin real behavior proof before merge.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: the PR can produce multiple complete origin snapshots and then discard later same-token candidates before retry. I did not run live provider probes because AGENTS.md cautions against live account/browser-cookie validation unless explicitly requested.

Is this the best way to solve the issue?

No, not quite: app-origin-first import with isolated snapshots is the right direction, but token-only de-duplication should not remove a distinct full auth bundle that could recover from 401/403.

Full review comments:

[P2] Keep same-token auth bundles retryable — Sources/CodexBarCore/Providers/Windsurf/WindsurfDevinSessionImporter.swift:184
The new per-origin snapshot loop can append both app.devin.ai and windsurf.com sessions, but the importer still de-duplicates candidates only by devin_session_token. If the app-origin bundle has stale or mismatched auth1/account/org fields while the legacy bundle has the same session token and valid headers, the legacy candidate is dropped before WindsurfWebFetcher can retry it after a 401/403; key de-duplication on the full auth bundle or otherwise keep distinct source/header bundles retryable.
Confidence: 0.83

Overall correctness: patch is incorrect
Overall confidence: 0.83

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 016f3b9e1314.

Label changes

Label justifications:

P2: The PR targets a normal provider-specific auth import failure with bounded blast radius.
merge-risk: 🚨 compatibility: The importer changes browser-session candidate ordering and fallback behavior for existing Windsurf users.
merge-risk: 🚨 auth-provider: The changed code selects and retries auth material used for Windsurf web API requests.
rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR body has exact-head tests and legacy-path live output, but needs redacted screenshot, terminal, log, or copied live output from a profile where app.devin.ai contains the complete session bundle; after updating the PR body, ClawSweeper should re-review automatically or a maintainer can comment @clawsweeper re-review.

Evidence reviewed

Acceptance criteria:

[P1] swift test --filter 'WindsurfDevinSessionImporterTests|WindsurfWebFetcherTests'.
[P1] make check.

What I checked:

AGENTS.md policy: The repository policy was read fully; its provider/parser testing guidance supports source and focused-test review here and cautions against live provider/browser-cookie probes unless explicitly requested. (AGENTS.md:1, 016f3b9e1314)
Current main behavior: Current main reads structured Windsurf Devin localStorage only for https://windsurf.com, then falls back to raw text entries, so main does not already implement the requested app-origin import. (Sources/CodexBarCore/Providers/Windsurf/WindsurfDevinSessionImporter.swift:216, 016f3b9e1314)
PR app-origin change: The PR head adds https://app.devin.ai before https://windsurf.com and appends complete per-origin snapshots as session candidates. (Sources/CodexBarCore/Providers/Windsurf/WindsurfDevinSessionImporter.swift:160, 54e83c212e52)
Remaining de-duplication defect: At the PR head, per-origin candidates are appended at line 184, but the list still returns through deduplicateSessions; that helper keys only on session.sessionToken at lines 102-108. (Sources/CodexBarCore/Providers/Windsurf/WindsurfDevinSessionImporter.swift:184, 54e83c212e52)
Fetcher retry behavior: The fetcher can retry later imported sessions on recoverable 400/401/403 errors, so dropping a distinct same-token candidate before this loop removes a valid fallback path. (Sources/CodexBarCore/Providers/Windsurf/WindsurfWebFetcher.swift:262, 016f3b9e1314)
PR proof statement: The PR body reports exact-head focused tests, make check, a live legacy SSO handoff, and CLI success, but explicitly says the new app-origin localStorage path could not be live-proved with the available account. (54e83c212e52)

Likely related people:

steipete: Blame and file history for the current Windsurf web importer/fetcher and token de-duplication point to commit 06fea2c. (role: feature introducer and recent area contributor; confidence: high; commits: 06fea2c897cc; files: Sources/CodexBarCore/Providers/Windsurf/WindsurfDevinSessionImporter.swift, Sources/CodexBarCore/Providers/Windsurf/WindsurfWebFetcher.swift, Tests/CodexBarTests/WindsurfDevinSessionImporterTests.swift)
Coooolfan: History search shows the earlier Windsurf provider addition in commit 3c0f072, covering the same provider area before the later web-importer refresh. (role: original provider contributor; confidence: medium; commits: 3c0f07223e8e; files: Sources/CodexBarCore/Providers/Windsurf/WindsurfDevinSessionImporter.swift, Sources/CodexBarCore/Providers/Windsurf/WindsurfWebFetcher.swift, docs/windsurf.md)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

kiranmagic7 · 2026-06-16T15:03:51Z

@clawsweeper re-review

Current head d15b576522477a5013601cb68ff6d8f5262cdcd5 has all visible GitHub checks passing (lint-build-test, Linux x64 CLI, Linux ARM64 CLI, GitGuardian). The previous ClawSweeper run did not complete, so requesting a fresh review on the green head.

clawsweeper · 2026-06-16T15:04:02Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27627261976
Updated: 2026-06-16T15:30:55.450Z

kiranmagic7 · 2026-06-16T17:46:11Z

@clawsweeper re-review

Current fixed head 2ab9f41 now has all visible GitHub checks passing, including macOS lint-build-test, Linux x64 CLI, Linux ARM64 CLI, and GitGuardian. Requesting fresh review on the green fixed head.

clawsweeper · 2026-06-16T17:46:15Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Failed
Detail: The targeted re-review did not finish cleanly. Check the workflow run for details.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27636893985
Updated: 2026-06-16T18:26:21.671Z

kiranmagic7 · 2026-06-17T05:31:32Z

@clawsweeper re-review

Current head e8aecd9f0e5b933dde6e58ab4215969cb72b30e1 has all visible GitHub checks passing (lint-build-test, Linux x64 CLI, Linux ARM64 CLI, GitGuardian). The latest test commit adds fetch-path coverage for the mixed-origin storage case: incomplete https://app.devin.ai localStorage is ignored, complete https://windsurf.com storage is used as the session candidate, and the outbound protobuf request uses the legacy session token/headers instead of mixing origin fields.

clawsweeper · 2026-06-17T05:31:35Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27668041549
Updated: 2026-06-17T05:58:14.843Z

kiranmagic7 · 2026-06-18T05:31:36Z

@clawsweeper re-review

Current head 037552caab2bce3f2c518737f98e92729f2eddf5 keeps the structured app/legacy origin snapshots and preserves the raw LevelDB text-entry fallback as an additional isolated candidate. All visible checks are green: macOS lint-build-test, Linux x64 CLI, Linux ARM64 CLI, and GitGuardian. The branch also includes focused importer coverage for structured app-origin data followed by a raw text fallback, preserving candidate order and labels.

clawsweeper · 2026-06-18T05:31:39Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Failed
Detail: The targeted re-review did not finish cleanly. Check the workflow run for details.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27750629815
Updated: 2026-06-18T10:28:08.186Z

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 811e62ea25

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-06-18T12:35:58Z

+                let sourceLabel = self.sourceLabel(candidate.label, suffix: snapshot.sourceSuffix)
+                guard let session = self.session(from: snapshot.storage, sourceLabel: sourceLabel) else { continue }
+                logger("Found Windsurf devin session in \(sourceLabel)")
+                sessions.append(session)


Preserve full per-origin session candidates

With the new per-origin snapshots, this loop can append both app.devin.ai and windsurf.com bundles, but the function still returns through deduplicateSessions, which keys only on sessionToken. If a stale app-origin bundle has the same devin_session_token as a valid legacy bundle but different auth1/account/org headers, the legacy candidate is discarded before WindsurfWebFetcher can retry it, so the intended legacy fallback still fails with 401/403. De-dupe on the full auth bundle or keep distinct source labels as separate retry candidates.

Useful? React with 👍 / 👎.

Co-authored-by: kiranmagic7 <[email protected]>

steipete · 2026-06-18T15:09:30Z

Landing proof for exact head 54e83c21:

structured session discovery checks the current app.devin.ai origin before the legacy windsurf.com origin and keeps candidates origin-isolated
raw LevelDB text remains a separate final fallback
18 focused tests, make check, and autoreview clean (0.82)
authenticated existing-Chrome proof populated the legacy origin through Devin Desktop SSO; exact CLI returned Windsurf web plan plus daily/weekly usage with no provider error
macOS, Linux x86_64/arm64, and security CI green

Public model identifier gate: N/A; no model-bearing content changed.

chatgpt-codex-connector Bot reviewed Jun 16, 2026

View reviewed changes

kiranmagic7 force-pushed the kiran/windsurf-devin-storage-origin-20260616 branch from 8503622 to 2ab9f41 Compare June 16, 2026 16:40

clawsweeper Bot removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jun 16, 2026

clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jun 17, 2026

steipete force-pushed the kiran/windsurf-devin-storage-origin-20260616 branch from 037552c to 811e62e Compare June 18, 2026 12:31

chatgpt-codex-connector Bot reviewed Jun 18, 2026

View reviewed changes

clawsweeper Bot removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jun 18, 2026

fix: read Windsurf sessions from Devin app origin

54e83c2

Co-authored-by: kiranmagic7 <[email protected]>

steipete force-pushed the kiran/windsurf-devin-storage-origin-20260616 branch from 811e62e to 54e83c2 Compare June 18, 2026 13:39

clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jun 18, 2026

steipete merged commit 553f80e into steipete:main Jun 18, 2026
4 checks passed

steipete mentioned this pull request Jun 19, 2026

Windsurf and Devin #1564

Closed

Conversation

kiranmagic7 commented Jun 16, 2026 • edited by steipete Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Proof

Scope note

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

clawsweeper Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kiranmagic7 commented Jun 16, 2026

Uh oh!

clawsweeper Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kiranmagic7 commented Jun 16, 2026

Uh oh!

clawsweeper Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kiranmagic7 commented Jun 17, 2026

Uh oh!

clawsweeper Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kiranmagic7 commented Jun 18, 2026

Uh oh!

clawsweeper Bot commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jun 18, 2026

Choose a reason for hiding this comment

Uh oh!

steipete commented Jun 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kiranmagic7 commented Jun 16, 2026 •

edited by steipete

Loading

clawsweeper Bot commented Jun 16, 2026 •

edited

Loading

clawsweeper Bot commented Jun 16, 2026 •

edited

Loading

clawsweeper Bot commented Jun 16, 2026 •

edited

Loading

clawsweeper Bot commented Jun 17, 2026 •

edited

Loading

clawsweeper Bot commented Jun 18, 2026 •

edited

Loading