Devtools stops selling agents and starts selling the plumbing: permissions, context graphs and orchestration around them.

The week in devtools

The dominant move this week was not another coding agent. It was the scaffolding that lets agents run safely inside existing pipelines: who they act as, what they can read, and which model they call. Three of the five biggest releases were about access control or context, not generation.

The second pattern is distribution. Vendors are shipping their capabilities as plugins and directory listings so that a customer's own agent can reach them, rather than asking customers to adopt a vendor's agent.

Leaders

GitHub made Copilot Fusion generally available: users pick Fusion and Copilot routes work across models, sometimes several per task. It also bundled Copilot into GitHub Enterprise for every licensed user, which removes the second seat count. Routing plus bundling is a pricing and product move at once.

GitLab took Orbit to general availability, a graph of code, merge requests, pipelines, vulnerabilities and owners that agents query instead of reading raw diffs. The security use case, mapping a vulnerable component to owners and exposure, is the concrete proof point.

Bitbucket shipped Agentic Pipelines to general availability on paid Cloud plans, with agents running as pipeline steps on Atlassian or self-hosted Linux runners. Alongside it came step-level permissions and container tokens that replace long-lived secrets, with breaking changes announced.

incident.io launched Extensions for its Nexus agent so teams can teach it their own debugging practice, and a plugin that installs its skills into any coding harness. The agent's reach is no longer limited to what the vendor built.

CircleCI put Functions into beta: versioned, pinned setup programs that are validated before the pipeline runs. That makes job configuration something an agent can edit with a safety net.

Wildcards

Home Assistant folded HACS into core as a built-in Marketplace in 2026.11. A smart-home platform shipping a first-party extension store on every install type is a devtools-style platform move from an unexpected place.

Redocly is renaming its Reunite config options to platform across several releases, with deprecations that still build with warnings. It is a migration story, not a feature story, and worth tracking for anyone on its config.

Themes that compounded

• Scoped permissions replaced broad credentials in Bitbucket pipelines and in Honeycomb resource-level MCP access.
• Agent context moved into structured graphs and extension points, as in GitLab Orbit and incident.io Extensions.
• Model routing and bundling arrived together at GitHub.
• Pinned, validated setup in CircleCI and agent steps in Bitbucket both put CI at the centre of agent work.

Watch this week

Bitbucket announced breaking permission changes, so watch for follow-up migration notes and whether GitHub and GitLab answer with their own step-scoped credentials. CircleCI Functions is in beta; a second Functions release or pinned-version tooling would confirm it is more than an experiment. Also watch whether Redocly's Reunite-to-platform rename lands as a hard break in a later config release.