fix(search): bind Devin OAuth to routed provider

[luvs01]

Motivation

• Prevent a credential-routing mismatch where admission checked route.providerName but the search path always consumed the canonical devin OAuth slot, allowing scoped keys to spend a different account's quota.
• Ensure the provider name used for admission and billing is the same identity used to select and commit the OAuth credential for Devin-backed native searches.
• Preserve Devin's OAuth refresh behaviour while resolving credentials from the routed provider slot so noncanonical Devin adapter rows cannot borrow the canonical slot.

Description

• Pass the routed provider name into the Devin native search handler by changing the call in src/server/search.ts to forward route.providerName to handleDevinAlphaSearch instead of the constant "devin".
• Extend getValidAccessTokenSnapshot in src/oauth/index.ts to accept an oauthProvider option and let resolveAccessSnapshotForAccount consult the requested OAuth provider definition when performing refresh logic.
• Update src/web-search/devin-executor.ts to request the OAuth refresh implementation (oauthProvider: "devin") while resolving the account snapshot for the routed credential slot, preserving Devin's refresh semantics without forcing a canonical slot selection.
• Add a regression test in tests/server/api-key-scope-alpha-search.test.ts that creates both a custom team-devin credential and a canonical devin credential and asserts the upstream request uses only the scoped provider's token; also update structure/runtime.md to document the invariant.

Testing

• Ran focused integration tests with bun test tests/server/api-key-scope-alpha-search.test.ts tests/web-search/devin-web-search.test.ts and observed all tests pass (13 passed, 0 failed).
• Ran type checking with bun run typecheck, structure validation with bun run structure:check, and privacy scan with bun run privacy:scan, each completing successfully.
• bun run test:changed could not run due to missing comparison refs in this checkout, so focused import-connected tests were executed instead and reported green.

---

Codex Task

---

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: e65bd1cc-eb50-4f83-a652-98e5a4821205

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Note

Newer findings are available below. Devin Review posted a newer report on this PR, in addition to the findings presented here.

Devin Review found 2 potential issues.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[luvs01]

이관됨: lidge-jun#6038

[luvs01]

동일 수정이 상류 저장소에 제출되어 이 포크 PR의 목적은 달성됐습니다.