fix(devin): bind alias tenant host to credential key

[luvs01]

Motivation

• Close a credential/host identity gap where an alias-derived tenant host could be selected without ensuring the transmitted API key belonged to that alias credential.
• Prevent cross-account or cross-region exposure of long-lived Devin keys when a devin/devin-cli rekey window and separately-sourced keys coexist.

Description

• Add an optional apiKey parameter to resolveDevinApiServer and require the alias credential to access === apiKey before borrowing its apiBaseUrl in src/oauth/devin.ts.
• Pass the resolved adapter key into resolveDevinApiServer from src/adapters/devin.ts so host and key are resolved as a bound snapshot.
• Add a regression test in tests/providers/devin-adapter.test.ts that proves an independently configured key cannot borrow an alias slot's tenant host, and update tests/providers/devin-login.test.ts to exercise the new binding.
• Document the invariant in structure/runtime.md and structure/providers-and-adapters.md to declare that alias-host fallback is only allowed when the alias credential owns the transmitted key.

Testing

• Ran bun test tests/providers/devin-adapter.test.ts tests/providers/devin-login.test.ts and both focused test files passed (66 tests total).
• Ran bun run typecheck, bun run structure:check, and bun run privacy:scan, all of which succeeded.
• Ran bun test tests/ci-workflows/file-size-ratchet.test.ts which passed its checks.
• A full bun run test execution in this container produced unrelated environment/timing and process-group failures (focused Devin coverage passed; full run: 27,761 passed, 34 skipped, 181 failed, 2 errors) so only the focused Devin tests are relied on for regression verification.

---

Codex Task

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c41fb60e-c9b8-4a26-900b-c626d478bedf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T00:27:27.359415Z	d225fc2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.