Added

• MCP servers can now override the RFC 8707 OAuth resource parameter via a new oauthResource field in the MCP server config (or --oauth-resource on devin mcp add / devin mcp login) — needed for identity providers like Microsoft Entra that reject requests containing resource.
• Command hooks now receive the agent’s session id (session_id for Claude-format hooks, trajectory_id for Windsurf-format hooks) and a per-turn id (prompt_id / execution_id) in their stdin payload.

Changed

• Command permission prompts now scope known program runners to the wrapped program: uv run ruff check offers to always allow uv run ruff rather than the much broader uv run. Also applies to poetry run, pdm run, pipenv run, rye run, hatch run, pnpm exec, pnpm dlx, npm exec, yarn dlx, and bun run.
• Sessions now start faster, especially when several reconnect at once.
• The devin migrate command (devin migrate hooks, devin migrate workflows) is now available for migrating from legacy Cascade.
• When the same skill name is loaded from more than one location, each copy now surfaces with a location prefix (/agents:foo, /claude:foo) instead of appearing as indistinguishable duplicates.

Fixed

• Hooks are now discovered in ancestor directories up to the repository root, matching how skills and rules are loaded.
• Improved support for deleting and renaming files with GPT-5.6 models.
• Image-heavy sessions no longer invalidate the provider prompt cache on every request once the trailing-image cap is reached; older images are evicted in batches, reducing token costs and latency in long sessions.
• The CLI no longer leaks a terminal/PTY per tool call: one-shot foreground commands free their shell session as soon as the command finishes, and deliberately retained shells (explicit shell_id, tty, or backgrounded commands) are capped at 16 with least-recently-used eviction.
• Reusing a shell id for a non-interactive command now works instead of failing with “This shell may not be functional”; a busy shell serializes the next command.
• Hooks are now deduplicated by source file, so a hook no longer runs multiple times when the same directory is re-added, workspace directories overlap, or a hook file is reached through a symlink.
• Telemetry: rejected, blocked, or permission-denied tool calls are now recorded with their actual failure reason instead of being mislabelled “turn complete”.

Added

• Added an /mcp slash command with a live MCP server status panel.
• ACU usage is now shown in the /usage command.
• Enterprise login policies are now enforced in the CLI.
• Added a sandbox.excluded allow/ask/deny config (user and team settings) to run specific commands outside the sandbox; excluded commands also skip the sandbox proxy environment.

Changed

• Edits produced in autonomous mode now produce reviewable diffs.
• Skill permissions: frontmatter now applies to auto-approvals.

Fixed

• Fixed command approval parsing for PowerShell $variable assignment prefixes.

Added

• Subagents can now be configured with a default model.
• Added an attribution option to the Devin Local config file; set it to false to suppress Devin mentions in commit messages.

Changed

• The MCP registry cache is now warmed during startup, so MCP servers are ready sooner.

Fixed

• On Windows, bash now resolves to Git Bash instead of the WSL launcher stub.
• Injected context is no longer included in auto-generated session titles.
• Fixed full-width wrapping of CLI question replies.

Plugins

Install bundles of skills from a GitHub repo, a git URL, or a local folder, and share them across projects. A plugin is any source containing a .devin-plugin/plugin.json manifest and a skills/ directory; its skills become available as /<plugin>:<skill>. A plugin can require other plugins (installed automatically), endorse optional ones, and forbid others — so a plugin can act as a curated, governed collection. Plugins are in beta and opt-in for enterprises, so behavior and configuration may change in future releases. See the plugins overview for details.

Enterprise controls

Expanded controls for admins to govern what Devin Local can do and which tools it can reach.

• Teams can define terminal command allow/deny lists, enforced through CLI permission scopes with exact-command matching and * wildcards.
• Org-level control to disable Devin CLI plugins: when set, the CLI refuses to install or update plugins and skips the skills from any installed plugins.
• The “Disable CLI access” team setting is now enforced for Devin Local (the CLI hosted in Windsurf), including the bundled agent registry and the allowed-MCP-server allowlist.

Added

• devin plugins install <source> installs a plugin (and its required plugins) from a GitHub owner/repo, a git URL, or a local path.
• devin plugins list shows installed plugins with their version and whether they are currently blocked by policy.
• devin plugins info <plugin> shows the skills a plugin provides and its required, optional, and forbidden lists.
• devin plugins update [plugin] re-fetches a plugin (or all plugins) at the latest version; local plugins are linked to their source folder so edits are live without re-installing.
• devin plugins remove <plugin> uninstalls a plugin, leaving any auto-installed required plugins in place.
• forbiddenPlugins entries accept glob patterns (e.g. acme/*, /secrets, https://gitlab.com/acme/) in addition to exact identities and the lone * lockdown.

Changed

• Improved authentication in third-party ACP clients, including JetBrains and Zed: both browser and manual sign-in now use the Devin auth flow, so the manual /login fallback works where it previously failed.

Added

• Gemini 3.5 Flash model support.
• New /cloud-attach command to attach to an existing cloud Devin session with full TUI rendering (tool calls, messages, plans, file edits). The existing /handoff behavior is unchanged.
• New /cloud-sessions [--all] command to list recent cloud Devin sessions and their attachable session IDs.
• Custom subagent profiles can opt in to nested subagent spawning via the max-nesting frontmatter field, overriding the default depth limit.
• Supported editor integrations, including Windsurf, now show the agent which file you have open, your cursor position, and other open editor tabs as part of its context.
• --export flag for exporting conversation history in ATIF format.
• New /fast slash command to quickly switch to SWE-1.6 Fast, with pricing comparison against the current model.
• Figma MCP servers can now authenticate with devin mcp add figma --url https://mcp.figma.com/v1 without additional configuration.
• When prompted for an MCP tool permission, two additional server-level options are now offered: approve all tools on the server for the current session, or permanently. This lets you grant broader access without re-approving each tool individually.
• Prompt navigation and collapsible command sections in terminals with shell integration. VS Code, Windsurf, Ghostty, iTerm2, kitty, WezTerm, and Windows Terminal users can now jump between prompts with keyboard shortcuts (e.g. Ctrl+Shift+Up/Down in VS Code), see prompt markers in the scrollbar, and collapse agent output sections (iTerm2). Prompt marks also survive session restore.
• Revert preview now shows line diff stats (+N -M) and a “View diff” button for all action types (restore, delete, recreate).
• show_hints config option to suppress “Did you know” tips between turns (default: on)

Changed

• Long conversations are compacted earlier in the background so the agent spends less time pausing when context is nearly full.
• ATIF exports now include richer per-step transcript details, including telemetry and timing metrics.
• Shell commands that continue running in the background after a timeout now report how long Devin waited before returning.
• The built-in Explore subagent can now use web search to research topics outside the codebase, in addition to its read-only codebase tools. It still cannot fetch arbitrary URLs or edit files.
• Homebrew installations are now externally-managed. The /update command will direct users to upgrade via brew upgrade devin instead of attempting self-update.
• HTTP MCP servers now try Streamable HTTP first and automatically fall back to legacy SSE when the server responds with an HTTP 4xx error, per the MCP spec.
• MCP OAuth callback pages now show Devin-branded success and failure screens instead of plain text.
• Renamed the product from “Devin for Terminal” to “Devin CLI” in user-facing UI, the REPL welcome and startup banner, slash command descriptions (/bug), bug report output, cloud handoff messages, version self-manage messages, tips, and public documentation. The binary name, config paths, and install URLs are unchanged.
• Revert preview now shows descriptive warnings for irreversible actions instead of empty placeholders.
• Read-only shell commands (e.g. ls, cat, pwd) no longer trigger irreversible action warnings during revert.
• Shell integration startup is faster, reducing noticeable delay when opening a shell.
• Trimmed the first-run welcome message for Devin CLI.
• Windows: default non-interactive shell is now PowerShell instead of Git Bash. Git for Windows is no longer required to run Devin CLI on Windows.

Fixed

• Image attachments in Windsurf now show the correct warning when the selected Devin CLI model does not support images.
• Responses silently truncated when the model hits its max output token limit now show a warning and exit non-zero in pipe mode instead of returning partial output as if complete.
• Persist the reduced trailing-image cap across turns after HTTP 413; prevents the cap from resetting to 20 each turn and triggering repeated 413 cycles
• Re-encode bmp/tiff/ico images to PNG at the message-forest chokepoint instead of forwarding them to Anthropic with an unsupported mime_type, which surfaced as messages.N.content.0.image.source.base64.media_type: Input should be 'image/jpeg', 'image/png', 'image/gif' or 'image/webp' 400 errors.
• Drop oversize (>5 MB) images whose bytes can’t be fully decoded instead of passing them through verbatim, which surfaced as image exceeds 5 MB maximum 400 errors.
• Typing into a multiple-choice question’s “Other (type your own)” field no longer drops e /space or treats j / k /digits as shortcuts; all characters now insert into the answer.
• Plan mode is now available when your organization requires sandbox mode. Previously /plan and /mode plan were rejected with “Plan mode is not available”, even though plan mode is read-only.
• Pre-user-prompt hooks that exit with code 2 now correctly block the prompt instead of being silently ignored.
• Reverting a step no longer reports a spurious “file was modified externally” conflict for files where the agent’s edit was rejected in the IDE.
• Reverting or editing a cancelled prompt (stopped before any output streamed) no longer fails with “could not resolve step.”
• Sandbox mode no longer leaves empty ghost dotfiles (.bashrc, .gitconfig, .mcp.json, etc.) in the project directory after commands finish.
• The in-session skill tool now finds skills behind symlinked directories under .windsurf/skills/, .agents/skills/, and .claude/skills/, matching devin skills list.
• /handoff now collects untracked files from the entire repository, not just the current subdirectory
• /handoff now includes untracked files in the git diff sent to cloud Devin, not just tracked changes
• “Always Allow” permission grants in Windsurf now persist across sessions. Previously, selecting “Always Allow” in the ACP permission dialog only granted the scope for the current session.

Web search

Search the web directly from your Devin CLI sessions. The agent can look up documentation, find solutions, and pull in relevant information from the internet without leaving the terminal.

Added

• Built-in OAuth device flow for GitHub MCP server. devin mcp add github --url https://api.githubcopilot.com/mcp/ now authenticates via device flow (enter a code at github.com/login/device) without needing --oauth-client-id.
• /copy command to copy the last agent response to the system clipboard. Works over SSH connections and on Linux desktops.
• Numbered options in select prompts can now be picked directly with the 1-9 keys instead of arrowing + Enter. The shortcut is shown as a digit prefix on each option in non-search prompts.
• web_search tool for searching the web during agent sessions.

Fixed

• Cancelling a session now also stops running subagents instead of letting them continue in the background
• Shell commands that redirect output to /dev/null (e.g. 2>/dev/null, >/dev/null, &>/dev/null) no longer prompt for write permission to /dev/null.
• Edit tool previews now show correct file line numbers instead of always starting from 1.
• Output token limit raised from 16k to match each model’s actual capacity (128k for Opus, 64k for Sonnet), preventing premature response truncation.
• Option+Backspace now correctly deletes words in select menus (user question “Other” field and search) on BS-mode terminals, instead of inserting ‘h’.
• Slash command output now has consistent visual separation from the prompt, matching how agent responses are displayed.

Added

• skill search can find model-invocable skills recursively under a project path and filter them by keywords.

Changed

• Default model is now SWE 1.6 Fast instead of Adaptive.

Fixed

• apply_patch diffs now appear incrementally as the patch is being written, not just after it completes. Both new-file and modify-existing-file patches show diffs progressively.
• Command hints now show the binary name used to launch Devin CLI when run through a renamed binary, symlink, or alias.
• Fixed process hang when MCP OAuth dynamic client registration fails. The local callback server was not properly shut down on error, causing the process to block indefinitely waiting for a browser redirect that would never arrive.
• /steps, /revert, and /fork now show and work with steps from before compaction. Previously, compacting a session made all earlier steps invisible and unrevertible.
• Text now correctly appears before tool calls in scrollback when both are produced in the same streaming turn.