A note about this build log entry: I published this after the week it covers. DevNitro reconstructed a draft from work-related entries in my journal, Git commit history, and time tracking. I reviewed, edited, and approved the final post. The story reflects what I knew and built at the time.
From the Backlog to the Build Log
Week of March 13 - March 19, 2026
What I Worked On
A developer who wanted to try DevNitro does not run Claude Code or an OpenAI subscription. He runs GitHub Copilot. So this week I added Copilot as a provider.
That sounds simple, but the interesting part is what I did not let it do. DevNitro talks to Copilot through the Copilot CLI, then disables Copilot's native tools and forces it to use DevNitro's tool calling instead. The model does the thinking. DevNitro owns the tools, the governance, and the record of what actually ran. This is the same reason DevNitro runs four different models against one build: the point is that you bring your own model, and the platform stays in control. I also added Anthropic native tool-call extraction and stabilized tool call IDs within a single turn, because a provider that renumbers its tool calls mid-turn will wreck your ability to match a call to its result.
Most of the hours, though, went to two less glamorous things. First, distribution: the CLI and the VS extension now refuse to run without an authenticated subscription, there is a real downloads page that serves the latest release for your operating system, and there is a template upgrade system with a manifest and a diff so an existing project can pull forward template changes. This continues the distribution work from two weeks ago. Second, I prototyped a new console chat UI on SharpConsoleUI running alongside the existing Terminal.Gui one, to see which gives a better experience.
What the AI Did Well
The onboarding flow came together nicely. When you invite someone, they now land in a personal workspace with a starter issue waiting, so the very first thing a new user sees is something to do instead of an empty screen. I also had an agent build a full profile-image system, upload, crop, and cache, with event-based updates so a new avatar shows up live across the UI. And it handled the wide, repetitive test work: this was another fifteen-hour testing week, mostly around distribution and subscription gating.
What Needed Correction
Two real security bugs surfaced, both the kind you only find by acting like a second tenant.
The first: I could create a company, a team, and an API key by only registering, without ever paying. The subscription guard was not covering resource creation. I closed that so creating real resources requires an active subscription.
The second was worse and more important. On the invite-members screen, I found that email addresses from other companies could be exposed. That is a cross-tenant data leak, the sort of thing that immediately erodes trust if it ships. I fixed the query so a company only ever sees its own people. Multi-tenant isolation is not a feature you demo. It is a thing that has to be true every time.
The Copilot path had its own snag: the packaged CLI could not find the Copilot binaries at first, so a provider that worked on my machine failed once installed. Runtime discovery, again.
What Shipped
DevNitro runs on GitHub Copilot as a provider, with its native tools disabled and DevNitro's governed tool calling enforced, plus Anthropic native tool extraction and stable per-turn tool call IDs. The CLI and VSIX require an authenticated subscription, backed by a downloads page and a template upgrade system. New users onboard into a personal workspace with a starter issue. Profiles have upload-and-crop avatars with live cache updates. And two security gaps, unpaid resource creation and cross-company email exposure, are closed.
The Numbers
| Category | Hours |
|---|---|
| Product / Features | 31h 50m |
| Testing | 15h 15m |
| Content | 2h 56m |
| Community | 1h 50m |
| Total | 51h 52m |
Another heavy testing week, which is exactly right for a week that touched subscriptions, tenant isolation, and a brand-new model provider. Those are the three areas where a silent bug costs the most.
Provider independence is not a slogan. It means the developer who only has Copilot can still use the platform, and the platform still owns the tools and the guardrails. This week proved that. It also reminded me that the second tenant is where your security assumptions go to die. I was most proud of the fact that adding in GitHub Copilot did not require any changes to the rest of the system. It literally just plugged in, and the rest of DevNitro kept running as if nothing changed. That is the point of a provider model: you can swap out the brains without touching the body.
Curious how this site was built?
Watch the 5-minute walkthrough at devnitro.com →
0 Comments
No comments yet. Be the first to share your thoughts!
Leave a comment