[sonder-albert]

Adds the published multi-devin package to the Magpie Plugins market.

• npm package: multi-devin@0.2.0
• provider: devin
• keeps the same Devin model endpoint and request translation as the listed plugin
• opens browser sign-in in a private window so another Devin account can be added without reusing the normal browser session
• supports the session-token method

The package README documents the difference from @magpie-community/opencode-devin-auth. The registry entry passes scripts/registry.mjs validation.

[yetone]

Thanks for packaging this up. We read every file in multi-devin@0.2.0 (the tarball matches its dist.integrity), diffed it against our packages/devin, and ran its 5 tests plus our devin suite against its index.mjs in WSL. Nothing in it is malicious: the only hosts are Devin's and Codeium's own and the loopback callback, and there are no install scripts or dependencies.

We're not listing it, for three reasons:

1. Credentials move to a separately published package. magpie runs one plugin per provider id. Once this is installed and chosen for devin, every saved Devin session token goes through multi-devin's code, including future versions we never review. For a subscription that already has a maintained community plugin, we don't list a second package that takes over its accounts.
2. It ships what the devin: add multi-account support #928 review asked to change:
   • SIGN_IN_TIMEOUT is 30 minutes (index.mjs:37), but magpie gives up after 10 (internal/provider/signin.go:48).
   • prompt: "login" (index.mjs:1112) replaces select_account, so every "Sign in again" asks for credentials from scratch.
3. The private window breaks some sign-ins:
   • With no Chrome, Chromium or Edge found, sign-in throws, with no fallback to the default browser (index.mjs:1043). That covers Safari-only, Firefox-only, Brave and Arc users, and snap or flatpak Chromium on Linux.
   • It returns url: "" (index.mjs:1125). magpie then has no link to show or copy, a GUI used over the LAN or in Docker loses the paste-the-callback fallback, and the user's link-only sign-in setting is ignored.

The private window itself is a good idea, and it belongs in our own devin package. Please carry it in #928 as a separate, opt-in sign-in method ("Devin (browser, private window)"):

• keep the plain browser method on the default browser with the real URL;
• fall back to returning the URL when no Chromium browser is found;
• set opened: true only when the launch worked;
• launch nothing when the sign-in is link-only.

With the 10-minute timeout and select_account restored as well, #928 can go in, and every Devin user gets this through the plugin they already have.

---

感谢！包的每个文件我们都看过并实际跑过，没发现恶意代码。不收录的原因有三个：

• 安装后，用户已保存的 Devin 凭据会交给一个独立发布、我们无法审查后续版本的包；
• 包里带着 devin: add multi-account support #928 审查要求改回的两处：30 分钟超时和 prompt: "login"；
• 机器上找不到 Chrome 或 Edge 时，浏览器登录会直接失败，而且不给登录链接。

无痕窗口登录这个想法很好，请在 #928 里把它做成我们 devin 插件的一个可选登录方式，那样所有 Devin 用户都能用上。