feat(desktop): add Devin onboarding, models, and config integration

[errfld]

Tracked by #6. Blocked by #2.

Why this issue exists

After #2 makes Devin first-class, users need the same setup/configuration path as Claude Code and Codex. The frontend must consume Rust catalog capabilities and generic ACP data; it must not grow a second Devin capability table.

Read desktop/src/features/agents/AGENTS.md before editing configuration behavior. Harness capability facts originate in KnownAcpRuntime and are projected over IPC.

Current touchpoints

• Onboarding order: desktop/src/features/onboarding/ui/onboardingRuntimeSelection.ts
• Setup/auth: desktop/src/features/onboarding/ui/SetupStep.tsx
• Defaults: desktop/src/features/onboarding/ui/DefaultConfigStep.tsx
• Existing icon: desktop/src/features/onboarding/ui/RuntimeIcon.tsx
• Missing catalog copy: desktop/src/features/settings/ui/harnessCatalogCopy.ts
• Catalog UI: desktop/src/features/settings/ui/HarnessCatalogDialog.tsx and harnessCatalogLogic.ts
• Model discovery: desktop/src-tauri/src/commands/agent_models.rs and agent_model_process.rs
• Config normalization: desktop/src-tauri/src/managed_agents/config_bridge/reader.rs
• Runtime config modules: desktop/src-tauri/src/managed_agents/config_bridge/
• Frontend projection: desktop/src/features/agents/lib/agentConfigCore.ts

Implementation guidance

Onboarding/auth

1. Add devin to ONBOARDING_RUNTIME_ORDER; this is the existing visibility policy, not render-time capability logic.
2. Reuse RuntimeStatus, ACP auth-method queries, connect mutation, polling, retry, and generic errors in SetupStep.tsx.
3. Use advertised browser/terminal methods. Add no token field and read no credentials file.
4. Setup detects readiness only; DefaultConfigStep remains the sole preferred-runtime persistence surface.

Models and ACP aliases

1. Extend generic normalization to accept option ID configId or id, label displayName or name, and selected/default currentValue.
2. Prefer stable config options over unstable models.availableModels.
3. Apply model changes through advertised ACP switching or catalog-declared DEVIN_MODEL on respawn.
4. Never hardcode Devin models; availability is account/policy/time dependent.
5. Preserve existing successful-empty versus failed-discovery semantics. A failed query must not erase a saved custom model.

Read-only config

1. Add desktop/src-tauri/src/managed_agents/config_bridge/devin.rs; register it in mod.rs and reader.rs.
2. Resolve documented platform config paths.
3. Parse only the normalized model (agent.model). If input is JSONC, use a bounded tested parser/helper; do not silently reinterpret malformed data.
4. Never return credentials, tokens, full MCP commands/args, or unrelated flattened settings.
5. If MCP config is surfaced, expose server names/enabled state only.

Catalog copy

Add one neutral vendor-sourced sentence following harnessCatalogCopy.ts policy. Reuse /harness-logos/devin.svg.

Acceptance criteria

• Onboarding covers missing, installing, logged-out, login-in-progress, failed, and ready Devin states.
• Devin can be selected as preferred runtime and reopened without losing selection.
• id/name/currentValue options show friendly names and the correct selected value.
• Model changes reach Devin through ACP or DEVIN_MODEL, with live/restart state accurately represented.
• No provider credential field is shown for Devin.
• Missing, malformed, inaccessible, and valid config files are handled distinctly without leaks.
• Claude, Codex, Goose, and Buzz Agent behavior is unchanged.
• No render component contains runtime.id === "devin" capability logic.

Tests to update

• desktop/src/features/onboarding/ui/onboardingRuntimeSelection.test.mjs
• desktop/tests/e2e/onboarding-agent-defaults.spec.ts
• desktop/tests/e2e/harness-management.spec.ts
• desktop/src/features/agents/lib/agentConfigCore.test.mjs
• desktop/src/features/agents/ui/usePersonaModelDiscovery.test.mjs
• desktop/src-tauri/src/commands/agent_models_tests.rs
• desktop/src-tauri/src/managed_agents/config_bridge/reader_tests.rs
• focused Devin config fixtures: valid, missing, malformed, JSONC, and redaction
• desktop/src/features/onboarding/ui/presetLogos.test.mjs or renamed built-in-logo guard

Suggested verification

. ./bin/activate-hermit
cargo test --manifest-path desktop/src-tauri/Cargo.toml agent_models
cargo test --manifest-path desktop/src-tauri/Cargo.toml config_bridge
cd desktop
pnpm test
pnpm check
pnpm test:e2e:smoke

Use pnpm build:e2e, never a plain production build, for manual mock-mode Playwright. Run just ci before handoff.

Out of scope

• Static models/pricing copy
• Editing Devin config
• Credential discovery
• A separate Devin settings screen
• Permission brokerage (feat(acp): route permission requests to authorized Buzz owners #5)
• Cloud Devin or remote Devin MCP

References

• https://docs.devin.ai/cli/reference/commands
• https://docs.devin.ai/cli/models
• desktop/src/features/agents/AGENTS.md