[wilbeibi]

Devin web sessions can now seed another agent by pasting a session URL into the existing fork --from command. Set DEVIN_API_KEY to an organization-scoped service-user key with session read access:

export DEVIN_API_KEY='your-api-key'
catchup fork --into codex --from 'https://app.devin.ai/sessions/YOUR_SESSION_ID'

Enterprise session URLs work too. The importer discovers the organization through /v3/self, reads events in pages of 50, and uses catchup's existing transcript renderer and session.Failure. It retains user/Devin messages and failed shell commands, including command/result pairs split across pages. Ordinary URL imports, including Devin attachment URLs, keep their existing behavior.

The API key goes only to api.devin.ai; authenticated redirects are refused. Import failure prevents launching the receiving agent with a partial transcript. The complete fetch has a one-minute deadline. No dependencies, caches, background work, or provider registry changes are added.

API stability and scope: event details come from the v3beta1 HTTP endpoint used by the official Devin MCP server, observed live on 2026-10-15. It is absent from the public v3 OpenAPI specification and may change. Shell output is already truncated upstream; API-reported field truncation produces additional warnings. Attachments, non-shell tool failures, compaction history, PAT/enterprise-key organization selection, remote discovery/search, and native Devin resume are outside this import path.

Read internal/devin/devin.go for the importer and the small readArtifact change for CLI wiring. The fixture contains selected, sanitized real event records in their original order.

Validation:

• go test ./..., go test -race ./..., go vet ./..., and go build ./... passed on macOS arm64 with Go 1.27.2. CI runs Go 1.25 on Linux and Windows.
• Live import into a local capturing executable produced 2 user messages, 3 Devin messages, and 1 failed shell command, with no API key in the prompt. This verifies import and launch wiring, not a real destination agent's reasoning.
• Kept: TestRunForkFromDevin exercises real HTTP responses through CLI handoff, using observed wire keys as its oracle. Seven mutations were caught: lost authorization, premature pagination termination, lost command input, successful commands misclassified as failures, duplicate failures, hidden truncation, and followed redirects. The attachment regression failed before narrowing URL recognition. TestRunForkFromURL also checks that a configured Devin key does not replace ordinary URL authorization.
• Explored: live API probes, the capturing executable, and mutation scripts remain outside the repository and are discarded. Proposed changes to existing tests: none.

Diff budget: runtime +169 / -5, tests and fixtures +164 / -0, docs +22 / -0; 355 added lines total.