Port upstream 0.64.0: Devin manual paste auth guidance

[Finesssee]

Port upstream 0.64.0 Devin manual authentication guidance (steipete#3694):

• Accept pasted credentials verbatim: a bare token, a Bearer ... value, or a full Authorization: Bearer ... line is normalized to the bearer token (manual_bearer_token), with case-insensitive prefix handling and whitespace tolerance; missing/empty values now produce actionable guidance (DevTools → Network → Usage & Limits → copy Authorization).
• New env aliases: DEVIN_AUTHORIZATION for the token, DEVIN_ORGANIZATION for the org (both fall through in the existing resolution order); blank values are ignored.
• Organization inputs tolerate org URLs: https://app.devin.ai/org/<org>/..., https://devin.ai/organizations/<org>/ etc. are normalized, but only for devin.ai / *.devin.ai hosts — non-Devin URLs pass through unchanged and fail auth as before.
• Error messages rewritten to point at the x-cog-org-id header and the paste workflow; auth failures now also cover 403 (in addition to 401) before non-auth statuses are considered.
• docs/PROVIDERS.md gains a "Devin manual authentication" section (Windows: no Chrome-session import).

Validation (at 3122f1f + lint companion 546a398, toolchain clippy 1.96):

• cargo fmt --all — pass.
• cargo test --manifest-path rust/Cargo.toml — full suite pass, 0 failed / 1 ignored (includes new tests: pasted-authorization normalization, missing-token guidance, devin.ai-only URL normalization, mockito round-trip asserting the authorization: Bearer fixture-token and x-cog-org-id: org_TJ2demo headers on GET /org_TJ2demo/billing/quota/usage).
• cargo clippy --manifest-path rust/Cargo.toml --all-targets -- -D warnings — pass. The companion commit fixes three pre-existing lint sites (alibabatokenplan manual_range_contains, kiro + openai nonminimal_bool) that clippy 1.96 flags identically on origin/main; no behavior change.
• Pushed port/micro-0.64.0-devin-paste-guidance 546a398; docs/PROVIDERS.md + provider backend only, no UI surface — browser-use UI proof not applicable.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Finesssee]

Validated 2026-10-01 at 3122f1f (port content) + 546a398 (lint companion):

• cargo fmt --all — pass.
• cargo test --manifest-path rust/Cargo.toml — full workspace suite pass, 0 failed / 1 ignored; includes the new tests: pasted Authorization: Bearer ... normalization, missing-token manual guidance, devin.ai-only organization-URL normalization (non-Devin hosts pass through), and the mockito round-trip asserting authorization: Bearer fixture-token + x-cog-org-id: org_TJ2demo headers on GET /org_TJ2demo/billing/quota/usage.
• cargo clippy --manifest-path rust/Cargo.toml --all-targets -- -D warnings — pass. Companion commit 546a398 fixes three pre-existing lint sites (alibabatokenplan manual_range_contains, kiro + openai nonminimal_bool) that the local clippy 1.96 flags identically on origin/main — no behavior change.
• Pushed port/micro-0.64.0-devin-paste-guidance (new branch); ls-remote head matches local 546a3987.
• Provider backend + docs only, no UI surface — no browser-use UI proof applicable.