[Bug]: Approving Devin's plan depends on the order of its plan-exit options, and one of them turns on bypass mode #34257

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

1. Run devin acp and create a session.
2. Call session/set_mode with plan.
3. Prompt: "Make a one-step plan to add a file named a.txt and then ask me to approve it using your plan exit tool."
4. Devin first sends a tool_call titled "Exit plan mode" with kind: "switch_mode", then a session/request_permission for the same toolCallId with these options:

5. Compare with selectPermissionOptionId and selectAutoApprovedPermissionOption in packages/provider-acp/src/server/adapter.ts (

   t3code/packages/provider-acp/src/server/adapter.ts

   Lines 1302 to 1323 in 79bca43

   	function selectPermissionOptionId(
   	request: EffectAcpSchema.RequestPermissionRequest,
   	decision: Exclude<ProviderApprovalDecision, "cancel">,
   	): string | undefined {
   	const optionIdOfKind = (kind: EffectAcpSchema.PermissionOption["kind"]) =>
   	request.options.find((option) => option.kind === kind)?.optionId.trim() || undefined;
   	if (decision === "acceptForSession") {
   	// Agents may offer only allow_once, and answering "cancelled" would stop the turn the user approved.
   	return optionIdOfKind("allow_always") ?? optionIdOfKind("allow_once");
   	}
   	return optionIdOfKind(decision === "accept" ? "allow_once" : "reject_once");
   	}
   	// Prefer allow-once; allow-always can persist beyond the session.
   	function selectAutoApprovedPermissionOption(
   	request: EffectAcpSchema.RequestPermissionRequest,
   	): string | undefined {
   	return (
   	selectPermissionOptionId(request, "accept") ??
   	selectPermissionOptionId(request, "acceptForSession")
   	);
   	}

   ).

I got the same list, in the same order, in seven sessions, including ones that entered plan mode from each of Devin's other modes (accept-edits, smart, ask, bypass). Devin also has a plan_normal option ("Yes, implement plan"), which I did not see offered. The problem doesn't depend on a particular Devin release. It applies whenever Devin offers more than one allow_once option on plan exit.

Expected behavior

Approving a plan should never put Devin into bypass mode unless the user chose that. If T3 offers only one "approve" button, it should choose plan_accept_edits (or plan_normal) by id, whatever the order.

Actual behavior

Devin gives both "yes" options the kind allow_once. T3 shows its default approval card, and both Approve and "Always allow this session" answer with the first allow_once option. Under full access, the automatic approval does the same. Today that is plan_accept_edits, which returns Devin to its default mode, so nothing goes wrong.

If Devin listed plan_bypass first, the same button would switch Devin to bypass mode, which approves every later tool call without asking. The card does not show which of the two T3 is choosing, and the user cannot pick the other.

ACP v1 says "kind is only a UI hint. The option name describes the scope" and says nothing about option order.

This is separate from #33136 and #33144, which change the "this session" choice only. #33144 leaves Approve answering with the first allow_once. It is also separate from #25553, which decides whether T3 asks before a mode switch, not which option it sends.

Possible fix

A Devin-specific choice for "accept" on plan-exit requests: prefer plan_normal, then plan_accept_edits, and never plan_bypass unless the user picked it. The automatic approval would use the same rule. A Devin approvalOptions could also show the choices with Devin's names, so the user can see and pick bypass deliberately. Matching on optionId avoids parsing the free-text name.

Impact

Minor bug or occasional failure. This is a latent risk. I have not seen T3 choose plan_bypass.

Version or commit

Current main. The code link above is pinned to a commit only so the line numbers stay correct. Not specific to a Devin version.

Environment

macOS, Apple silicon, Devin over ACP.