[hessabi]

Re-file of the former #1, as requested in #4, rebased onto current main.

What was wrong: devin auth status exits 0 when you're logged out. It prints "Not logged in.", a credentials path, and a hint to run devin auth login. getDevinAuthStatus tested the output with /logged in/i, which matches that text too. So /devin:setup reported authenticated: true and ready: true for a logged-out user.

How it was observed: on Devin CLI 3000.10.x a logged-out devin auth status prints exactly that, with exit 0. A logged-in session starts with "Logged in (via Devin).", followed by indented sections that include "Email:" and "Tier:".

What changed

• getDevinAuthStatus now counts a session as logged in only when a line starts with "logged in" (case-insensitive) and the output doesn't contain "not logged in".
• The fake devin fixture gets a loggedOutExitZero option that reproduces the logged-out, exit 0 output.
• A new setup test asserts authenticated: false and ready: false for that case.

How tested

• node --test: 68/68, which is main's 67 plus the new test.
• The new test fails without the devin.mjs change.
• Checked against a real logged-in CLI: it still reports authenticated, with email and tier.

[TheOnlyFusionCube]

Approved. The new positive, line-anchored logged in match plus explicit not logged in exclusion fixes the misleading exit-0 output without changing binary resolution from #13 or other auth failure paths. The fake CLI reproduces the real logged-out banner and /devin:setup --json checks both authenticated: false and ready: false. The Test matrix (Node 18/20/22, npm test and npm run doctor) passed. HOL Scanner still fails, but this PR reports the same one high as current main (98/100); do not lower security thresholds to address that separate baseline issue. No blocker found in this patch.