[devin-ai-integration]

What changed

• Assigning a task to an agent now creates an agent thread and user message containing its details, then starts the existing agent-turn pipeline. Persisted assignment identity prevents repeated starts; startup failures are explicit. Existing task tools and authorization remain authoritative for agent status updates.
• Preserve oauth through MCP create/update and Test connection parsing instead of silently saving none. Test connection now uses the stored OAuth session through the existing runtime auth provider. The user confirmed successful Monid authorization and agent tool calls; this follow-up addresses the separate connection-test failure.
• Place contextual-left and docked-right panel resize handles outside the white surfaces, retaining inset placement for floating panels.
• Implement the approved flat MCP/Skills card-and-dialog design with shared shadcn Card, Dialog, Select, Switch, Tabs and AlertDialog components. Use explicit Manage actions, deletion confirmation, content-width Configuration/Tools tabs, and spacing instead of internal dividers. Preserve configuration, OAuth controls, tool policy, scope actions and mutation callbacks.

Risk and rollback

• Security or tenant-boundary impact: assignment preparation rechecks workspace access, assignee visibility and generation inside the transaction. Task tools retain existing grants and approval policy. OAuth callbacks and credentials handling are unchanged.
• Billing or provider-cost impact: agent assignment now starts real work and can incur normal provider usage. Human assignments do not dispatch. Check the agent thread before retrying an uncertain start.
• Data migration impact: additive optional workItems.assignmentExecution field; no backfill. Old records remain readable and can prepare an assignment when explicitly reassigned. Backend and web must be deployed at matching revisions.
• Rollback plan: revert web dispatch first, retain additive backend schema/data until callers are rolled back, then remove only when safe. Reverting does not cancel already-running agent turns.

Verification

• Owner acceptance: the user confirmed "i tested, it works" after the MCP connection-test and compact-tab fixes, and requested ready-for-review status. This is user-reported acceptance, not an additional agent-run hosted test.

• Follow-up 305aa5c: 10 focused MCP route/card tests, targeted ESLint, direct root TypeScript and diff checks passed. Regression tests exercise the real OAuth transport provider with stored credentials, ignore client-supplied tokens, and reject inaccessible servers. Network connection/tool listing is mocked. Local rendered checks confirm compact tabs on desktop/mobile and in dark mode. Final CI for this head: 22 passed, 0 failed, 0 pending; Paid Gateway Canary skipped. Required quality/security gates and PR Preview are green.

• Latest UI revision: 9 focused tests, changed-file ESLint, direct root TypeScript and diff checks passed. Final CI: 22 passed, 0 failed, 0 pending; Paid Gateway Canary skipped. Required quality/security gates and preview checks are green.

• Rendered actual production components with app CSS in an isolated local fixture: light/dark, desktop/mobile, MCP auth/tool policy edits and save/connect/test callbacks, Skills save and Active, and delete cancel/confirm. Fixture callbacks do not contact real services.

• Previous head CI settled: 22 passed, no failures or pending checks, Paid Gateway Canary skipped. Full suites, typecheck, lint, secret scan and required quality/security gates passed.

• Focused Node suites passed; final WorkService suite: 12 passed. MCP create/update parser regression: 4 passed.

• Convex Work suite: 39 passed. Resize unit test: 1 passed.

• Changed-file ESLint: zero errors, one existing restricted-import warning. Shared-isomorphic and diff checks passed.

• Local full typecheck hit desktop-shell/bridge fingerprint and manifest boundary checks; direct TypeScript check passed and CI full typecheck subsequently passed.

Preview evidence

• Canonical PR URL: fix: agent task execution, MCP OAuth, sidebar gutters, and extension cards #363
• Canonical preview: https://pr-363.preview.getoverlay.io
• Current PR head SHA: 305aa5cd9f196949da96743aab5b6790ea79cadb
• Preview checks are green for the follow-up head 305aa5c. Local component evidence predates a behavior-preserving MCP footer extraction; hosted feature QA remains pending.
• Prior OAuth browser verification head: d1c892e9e9c3051735b6ba728a330dcf5be7b493. Hosted feature QA of the new UI head remains pending.
• Verified deployment: READY dpl_64SdcsFXPAazQyGZFa5swGZGDa3B, matching the prior OAuth verification head, not the latest UI revision. Preview controller validated isolated preview/pr-363; build logs and browser runtime both identify https://industrious-viper-605.convex.cloud.
• Browser actions checked: create and edit Monid OAuth MCP configuration, reload/reopen persistence, Connect returning 200 with PKCE S256 authorization, and navigation to the real Monid login page.
• User-reported verification: Monid consent and authenticated agent tools work. Independently untested: full Monid consent/callback/token exchange and the follow-up Test connection flow against a real authorized Monid account. Task execution and sidebar interaction browser QA also remain outstanding.
• Non-blocking observation: pre-Connect automatic tool discovery displays No OAuth state was provided for this MCP authorization. Source tracing confirms discovery runs before interactive authorization has a state; it does not block Connect. This initial card warning remains.
• Approved mockup: internal/plans/mockups/extension-cards-dialogs.html. Production components now implement this design.

Current component rendering

Actual production components with app CSS and fixture data, not hosted backend QA:

OAuth persisted after reload	Real Monid login reached

• Sensitive changes: callbacks, billing, migrations, and tenant boundaries were checked on the isolated PR preview as applicable
• Schema changed: expand/contract compatibility and backfill/rollback steps are documented

Main changes automatically deploy to Vercel Production through Git integration.
Integration verifies the live SHA and affected behavior; backend changes also need
Convex synchronization from clean canonical main after matching web is live.
A successful preview build still needs feature QA.

• I own this contribution or have written authority to submit it, and I identified all third-party material
• CLA Signatures check is green
• Relevant focused tests pass
• Typecheck passes when contracts changed
• Living documentation was updated when required
• No credentials or customer data are included
• Browser or deployment evidence is attached when behavior depends on a hosted environment

Link to Devin session: https://app.devin.ai/sessions/725db300351b4894a3bc35d884db40fd
Open in Devin Desktop: https://app.devin.ai/desktop/session/725db300351b4894a3bc35d884db40fd?variant=devin
Requested by: @DevelopedByDev

Follow-up compact tabs

Local production-component rendering:

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
overlay-landing	Ready	Preview	Nov 1, 2026 10:42pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
overlay-admin	Ignored		Nov 1, 2026 10:42pm UTC

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
layernorminc	🟢 Ready	View Preview	Nov 1, 2026, 10:29 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[DevelopedByDev]

Integration acceptance at 3df2446a3966538f52305a5cda854da0a87947d4

• Exact-head READY Preview: https://pr-363.preview.getoverlay.io; deployment dpl_2stie9XgnRV33W58s4mLBSxXwnBR, isolated backend industrious-viper-605.
• Fixed stale living docs for task auto-dispatch, startup uncertainty, OAuth connection testing and the card/gutter UI. Resolved current-main changelog conflict preserving both entries.
• 70 focused tests passed: Work/dispatcher/MCP server suites 27, Convex Work 39, extension cards 3, resize placement 1. Root TypeScript, full pre-push checks and all nine required current-head PR contexts pass.
• Live assignment: synthetic native agent created; assigning a task starts its existing workflow, produces one kickoff and one assistant response, and executes real task tools. Persisted events show todo → progress → review; run completed with PR363_TASK_QA_OK. On the final head, repeated same-assignee PATCH returns 200 with unchanged execution identity and no duplicate kickoff/response. Final-head browser reopening shows the saved answer.
• Hosted MCP editor saves OAuth, retains it after reload, and shows connection-test errors inside the dialog for an unconnected server. Positive saved-session transport, token-injection rejection and inaccessible-server tests pass. Full external Monid consent/callback was not independently repeated; the builder records owner acceptance for that provider flow. No new credentials or production MCP configuration were created.
• Hosted Skills create/edit/reopen and delete cancel/confirm passed. Light desktop and dark mobile 390px dialogs render without page overflow. Final-head contextual and docked-right handles occupy the outer gutters; agent output remains visible. No browser runtime errors observed.
• Preview started with the existing guarded controller locally because the Actions controller was waiting behind another PR build; canonical controller sources were unmodified and identical to origin/main. Existing pinned Preview credentials and isolation guards retained.

No blocking review findings remain. Proceeding with authorized local-owner merge, native Git production verification and canonical-main Convex sync.

[DevelopedByDev]

Release verified at 14c84149bab6d3b7e72e37787c8c4eedde44a95f.

• fix: agent task execution, MCP OAuth, sidebar gutters, and extension cards #363 merged with a meaningful merge commit. Native Git Vercel production dpl_4UsYZicyqhZFpGCSLziwL3WFqXJs is READY; www.getoverlay.io resolves to that exact deployment/SHA.
• Convex production colorful-chickadee-419 was dry-run and deployed from clean current canonical main after matching web activation, with TypeScript enabled and no indexes deleted. Live metadata verified work/workItems:prepareAssignment and completeAssignment absent before sync and present after. The task schema field is additive; no data backfill or production task dispatch was performed.
• Authenticated post-sync production Work renders normally. Session, Convex-token, work/context and discovery return HTTP 200, with no browser runtime errors. Production smoke is read-only; live assignment/tool execution, status events and duplicate prevention were exercised on the isolated Preview, as recorded above.
• All required PR contexts pass, and the post-merge main Security Checks run 41358832812 completed successfully.
• Closed Preview cleanup completed via the existing guarded controller from canonical main with unmodified controller files matching accepted main. Exact PR363 domain, alias, branch app URL and isolated backend removed with absence readback; former URL returns HTTPS 404. No other Preview backend was targeted.
• Six unrelated canonical files restored with matching hashes/modes, plus the original desktop submodule revision. QA browsers closed.
• External Monid consent/callback was not independently repeated. Saved OAuth-session transport and auth-boundary regressions passed; the builder records owner acceptance for the provider flow.