Devin CLI Updates & Release Notes

Added

• New mode slash commands alongside /ask and /plan : /code returns to Code mode, /smart switches to Smart mode, and /bypass (alias /bypass-permissions ) switches to Bypass Permissions. With a prompt they switch and then run it under the new mode.
• /session-stats now ends with a “by model” chart of the session’s billing metric, with per-model totals
• Disable tools by name with disabled_tools in your user config.json , for example "disabled_tools": ["webfetch", "web_search"] .
• Set agent.compaction_threshold_tokens in the user config to trigger automatic compaction earlier than the context-window-based default.
• Added an agent.codex_tools setting (off by default) enabling GPT models to use the Codex tool set — shell commands for reading and searching, apply_patch for edits
• Beta: shell.exec_shell (bash / zsh / fish / pwsh ) selects the shell the agent’s exec tool uses, and the agent can now pick a shell per command instead of always getting the machine’s default.
• Ctrl+Y pastes the text most recently deleted with Ctrl+U , Ctrl+K , Ctrl+W , Alt+D , or Alt+Backspace back at the cursor, with a footer hint until it is yanked back. Rebind it via editor.yank .
• Refusal fallback: when a provider refuses a request under its usage policy, Devin can switch to another model and retry the turn. Set DEVIN_REFUSAL_FALLBACK to a comma-separated list of models (or pass --refusal-fallback to devin acp ); disabled unless configured.
• PreToolUse hooks receive a tool_provenance object identifying the skill or MCP server behind the call, and the config file or plugin that declared it.
• Terminals without kitty keyboard protocol support (e.g. Apple Terminal) see an “Alt+Enter for multiline prompts” tip.
• Skill list and search can target active plugin skills without changing their existing project-path behavior.

Fixed

• Read-only commands prefixed with cd, such as cd /repo && find ., now resolve relative paths against the target directory for permissions. Ambiguous paths and output redirects continue to fail closed.
• The CLI no longer grows in memory on every screen redraw while waiting on an open prompt or a long-running turn.
• A pre_tool hook that blocks a tool call now returns its reason to the agent and lets the turn and sibling tool calls continue.
• Windows shell sessions no longer risk hanging indefinitely when closed immediately after startup.

Added

• New devin rm deletes a session, with confirmation by default and --force for non-interactive use; deletion is refused while another Devin instance has the session open.
• New devin desktop shortcut opens Devin Desktop if installed, and a bare path such as devin . opens Devin Desktop on that path.
• New devin doctor command checks custom subagent profiles for incorrect frontmatter.
• New /recap command catches you up on the session with a short agent-generated summary of what was worked on, key decisions, and where things stand.
• New /rename renames the current session.
• New Alt+P shortcut toggles Plan mode without clearing the input.
• /handoff now asks which OS the cloud session should continue in when your organization has more than one platform available, instead of silently reusing the last cloud session’s environment.
• Ask and Plan modes can now use the read-only webfetch and notebook_read tools for research.
• Plugins are now compatible with the Agent Plugins 1.0.0 format.
• Plan mode writes plans to a file so they always have a heading and summary paragraph.
• The subagent tray and detail view show which model a subagent is running on when it differs from the parent’s model.
• Accounts billed in credits now see a model’s credit multiplier in the model selector (e.g. 1.25 credits / message) instead of only a relative cost label.
• The input footer shows a “ctrl+v to paste image in clipboard” hint while an image is on the system clipboard.

Changed

• Instant slash commands (/status, /context, /fast, /session-stats, /help, etc.) now run immediately while the agent is working instead of queueing until the turn finishes, render their replies in scrollback instantly rather than through the typewriter, and pair each reply with its own command.
• Unknown slash commands now fail instantly with Unknown command: /notacommand. Use /help to see available commands.
• /model, /models, the model keyboard shortcuts, and the footer model picker now apply while Devin is working, so the next request uses the selected model.
• /btw now opens a side-chat panel that runs in parallel with the main agent: questions are answered from the conversation’s context while the agent keeps working.
• /usage shows a richer panel: daily/weekly quota progress bars with reset times, an extra usage balance line when present, and more info on the current session.
• The session picker (devin -r, /resume, devin ls) shows all sessions by default with the current directory’s sessions sorted to the top; Alt+G narrows to the current directory.
• The background shells tray (Ctrl+B) lists all running background commands.
• Command card titles show the meaningful command instead of the first shell token, skipping cd, environment prefixes, and wrappers like sudo / env.
• Queued messages render in a distinct “N queued” section above the input box with ↑ edit / ↵ send now hints.
• Faster session startup, especially in large repositories with many rule and skill files.
• On Unix, cancelling or timing out a shell command now sends SIGTERM to the process group first and SIGKILL only after a 5-second grace period.
• Read-only git command detection is now shared across bash, PowerShell, and smart mode.
• /bug opens the bug submitter when run without a description, rejects submissions from outdated CLI versions, and shows a checklist receipt of what was sent (with the local zip path for zero-data-retention accounts).
• Presentation polish across the REPL: agent output is inset by one column with tighter tool cards, code blocks are indented two cells with balanced padding, inline code has padded backgrounds, /help aligns and dims descriptions, the interrupt hint turns a warning color, and the first-run welcome screen is a compact tips card.
• Broader Claude plugin compatibility: hooks are also loaded from hooks/hooks.json, hook commands additionally receive CLAUDE_PROJECT_DIR and CLAUDE_PLUGIN_ROOT, and subagent profiles accept the tools frontmatter field as an alias for allowed-tools.
• The model picker has been redesigned for improved price transparency and more intuitive navigation.

Fixed

• Hitting a monthly usage limit now shows a “Usage limit reached” alert with a clickable “Request more usage” link instead of a raw permission-denied error, and the “Quota exhausted” alert links to usage settings.
• Background shells keep streaming live output to their command card after the turn ends — including after an interruption — and show the full output on completion instead of a 1000-character preview.
• Command cards carry the full retained terminal scrollback (up to ~3500 lines), show a scrollable ~100-line window while streaming, elide the middle of very large output with a marker instead of showing only a tail, and no longer lose chunks from commands that emit fast bursts.
• Shell commands with endless output no longer grow memory without bound.
• --continue now continues the most recent session in the current directory that is not already open in another process, instead of failing on a locked session.
• A single invalid value in config.json no longer discards all user settings.
• Permission rules now match correctly when a workspace, config, or granted directory name contains glob metacharacters such as [, ], {, }, *, or ?.
• SessionEnd lifecycle hooks now run when a session ends, with a reason matching Claude Code’s vocabulary.
• Stop hooks now receive last_assistant_message in their stdin payload, so they can read the agent’s final response without parsing a transcript. Hooks contributed by a plugin also get DEVIN_PLUGIN_ROOT.
• Hooks from a second workspace directory now run in that workspace, and DEVIN_PROJECT_DIR always points at the hook’s project root.
• Skills, rules, hooks, and subagent profiles that come from an installed plugin now appear in the Skills, Rules, Hooks, and Subagents lists, labeled with the plugin’s name.
• Invoking a skill passes the whole SKILL.md to the model instead of truncating it to the tool-result budget, and $ARGUMENTS / $1 – $9 placeholders are interpolated with the arguments passed to /skill-name.
• Skills discovered mid-session are listed again after context compaction instead of disappearing for the rest of the session.
• Ask and Plan modes can use web search for read-only research when the tool is available.
• Pressing x on the tray’s Subagents tab kills only the selected subagent instead of cancelling the whole turn.
• An interrupted auto-update can no longer leave the installation broken with current pointing at a missing version directory; devin update also repairs an already-dangling installation.
• Windows: multi-line pastes no longer split into separate prompts, pty_for_noninteractive_exec no longer makes every non-interactive command hang, cancelled commands kill the whole process tree, and Chrome discovery checks per-user installations.
• Terminal rendering fixes: multiline paste works in terminals without bracketed paste, selection lists scroll instead of overflowing short terminals, searchable pickers move the highlight to the adjacent visible row, wrapped inline code no longer leaves a stray highlighted cell, the live area flickers less when it resizes, streaming tool-call arguments animate smoothly again, and sending queued messages no longer shows a spurious cancellation prompt.

Added

• devin auth status now shows the primary organization for enterprise accounts.
• Nested AGENTS.md files, lowercase agents.md files, and rules in supported dot-directories are now discovered and remain scoped to the directory where they apply.
• Completed ask_user_question prompts now appear as /steps entries that you can revert to or fork from. Reverting to a question asks it again.
• Press Esc twice within three seconds to interrupt a running turn; Ctrl+C still interrupts on the first press.

Removed

• We have removed the shell integration feature. It was in preview and we have decided not to make it generally available. Use devin shell remove to clean up old integration blocks.

Changed

• Slash-command completion descriptions now appear for every result in a consistent aligned column.
• /add-dir now checks workspace trust before attaching an untrusted directory, makes attached directories writable in the OS sandbox, and revokes that access when they are removed. Skills from attached directories also appear immediately in slash-command completion.
• Plugin installation now uses personal plugins by default, syncing to Devin Cloud and other devices; use --local for a device-only install.
• All devin plugins commands now require login, and plugin MCP servers discovered after a workspace root is attached or first touched now register correctly.
• Permission denials now identify the layer responsible.
• Plan mode now uses the normal permission system, and “always allow” choices appear only when they can take effect.
• ACP session persistence and resume now restore titles, modes, and usage totals consistently. /continue resolves the most recent session, /fork defaults to the latest step, and ACP revert can cancel an active turn before rewinding.
• /fast now selects SWE-1.7 Lightning when available, falling back to SWE-1.6 Fast or other fast models.
• Quota-exhaustion messages now link to usage settings for on-demand usage and auto-reload.

Fixed

• Ensured ask_user_question requests now use standard ACP elicitation so third-party clients like Zed can answer them.
• Large-file reads through ACP are bounded and paginated instead of repeatedly rereading overflow files. Late terminal flushes now preserve complete output and cannot reopen completed command cards.
• Model refusals now show a warning instead of silently ending a turn, and image prompts continue to inference after captioning completes.
• Resuming, continuing, or reverting a session no longer duplicates workspace context, and skill invocations can be repeated after a session restart.
• Non-UTF-8 command output is reported with the real output and exit code.
• Linux sandbox startup no longer hangs while expanding filesystem globs; unsupported glob rules are ignored and logged, while trailing /** continues to cover a directory tree.
• Notebook edits now change only the target cell and preserve unrelated metadata, outputs, attachments, ids, and fields.
• Uninstalling a plugin also removes and stops its MCP servers, and plugin registries are now flushed safely before replacement so crashes cannot erase them.
• Shell commands blocked on a sudo password prompt now fail fast with an explanation instead of hanging.
• Smart mode and other flag-gated features now refresh immediately when authentication or team context changes.

Added

• New smart permission mode: workspace edits auto-approve like Accept Edits, and a fast model decides whether other actions (shell commands, fetches, out-of-workspace writes) are safe to auto-run, falling back to the normal prompt otherwise. Auto-approval is limited to routine development work (building, testing, linting) — package installs, downloads that execute code, mutating git, rm, sudo, kubectl delete, cloud CLIs, and anything destructive always prompt, as do sensitive paths (dotenv, key material, Git config, agent configuration). Switch with /smart, /mode smart, --permission-mode smart. Available in all builds, off unless the server-side rollout flag is enabled for your client.
• Plugins can now contribute rules, hooks, MCP servers, and custom subagents, not just skills. Plugin AGENTS.md / AGENT.md / .windsurfrules load as always-on rules, hooks.json loads alongside project hooks, MCP servers declared via a root .mcp.json or an inline manifest mcpServers map run for the session, and agents//AGENT.md files surface as : subagent profiles. devin plugins info and the install trust prompt list all of them before you confirm, and devin rules list / devin mcp list include them.
• New plugin sources and manifest options: the git-subdir source kind installs a plugin living in a subdirectory of a shared repo (devin plugins install acme/vendor-plugins#plugins/stripe), a skills manifest field controls where skills load from (or disables them with []), and a Claude-compatible .claude-plugin/plugin.json manifest is used when no .devin-plugin/plugin.json is present.
• MCP prompts support: prompts offered by connected MCP servers are available as /mcp____ slash commands, with arguments mapped positionally onto the prompt’s declared arguments.
• Editable command approvals: the shell-command permission prompt now offers “Edit command” to tweak the proposed command inline before approving, and “Describe change to command” to have a fast model rewrite it in plain language (out-of-band — nothing enters the conversation) for review. ACP clients get the same affordances.
• Command permission prompts now offer a global “Yes, always allow commands in all projects” option saved to the user-level config.json, alongside the existing per-project option. Web-fetch prompts gained an equivalent “always allow all web fetches” option.
• Configurable keybindings via a keymap section in config.json, keyed by context then action (e.g. { "keymap": { "global": { "clear_screen": "ctrl-shift-k" } } }). /shortcuts now lists every binding across all contexts, shows each action’s context.action identifier, and lets you rebind interactively. Ctrl+C cannot be unbound.
• Copilot agent skills are discovered automatically from .github/skills/ and ~/.copilot/skills/, toggled with the copilot key under read_config_from.
• New subagents_enabled setting in config.json (on by default) turns the run_subagent / read_subagent tools off; changes apply live to the running session.
• In plan mode, a megaplan keyword (megaplan, ultraplan, masterplan) triggers extra planning guidance: the agent plans more extensively and always asks at least one clarifying question before writing the plan.
• Old log files are gzip-compressed on startup — logs from finished processes untouched for 48 hours become .log.gz (still searchable with zgrep / rg -z).
• Administrators can configure the CLI’s outbound HTTP proxy through the MDM-distributed enterprise policy file (system.json); it takes precedence over the user config, and the updater honors it too.
• devin acp --model (or DEVIN_MODEL) sets the default model for every session the ACP server creates, matched the same way /model matches it.
• devin acp --cloud (insiders) relays the ACP connection to Devin cloud instead of running the local agent.
• /btw, /loop, /mcp, /context, /add-dir, /undo-add-dir, /workspace are now advertised as agent-side ACP slash commands, so any ACP client (Devin Desktop, JetBrains, or Zed) can invoke them and their progress streams back as session updates. /remove-dir and /workspaces were added as second names for /undo-add-dir and /workspace.

Changed

• MCP servers now live in dedicated config files — ~/.config/devin/mcp_config.json (%APPDATA%\devin\mcp_config.json on Windows), .devin/mcp_config.json, and .devin/mcp_config.local.json — instead of the mcpServers key of config.json. Existing mcpServers entries in config.json are migrated automatically on startup. See MCP Configuration.
• Shell commands run by the agent now inherit your login shell’s environment (.bashrc / .zshrc / .zprofile / fish config), so nvm, pyenv, rbenv, direnv, and custom PATH entries just work. Snapshotted once per session; macOS/Linux only.
• Plan mode now allows read-only MCP tools (those annotated readOnlyHint: true) plus listing MCP servers, tools, and resources, so the agent can gather context while planning.
• Relative plugin references (./path) in manifests and repo plugin configs now resolve against the entity that declares them rather than the process working directory — including forbiddenPlugins deny entries, which previously matched nothing. Manifests with unresolvable relative references now fail to parse instead of carrying a silently dead entry.
• Organization sandbox enforcement now applies to running sessions: team settings are refreshed at each prompt, and turning on required sandboxing mid-session refuses further prompts with a message asking you to restart.
• /session-stats renders every usage dimension the server reports — credits, ACUs, agent messages, turn continuations, token usage — using the server’s own labels and grouping, the Model row names the model that actually served the billed turns, and totals persist across resume.
• Automatic context compaction is no longer surfaced in the scrollback or the ACP conversation view; an explicit /compact still confirms in the transcript.

Fixed

• Interrupting the agent now pauses running subagents instead of leaving them working in the background: they park with their state intact and resume on your next message. Subagent activity also survives a session reload, and a subagent’s approval prompt now shows the command and names the requesting subagent.
• Sending a queued message immediately (Enter on an empty input while Devin is working) actually interrupts the current turn instead of leaving the message queued until the turn finished.
• Exiting plan mode now injects an explicit mode-change announcement, so the agent reliably starts acting in the new mode instead of continuing to follow plan-mode restrictions from earlier in the conversation.
• Permission rules with recursive globs (e.g. deny: ["Read(/etc/**)"]) now also cover the base directory itself.
• On Windows, Deny rules now block a forbidden command hidden behind a safe leading command in a &&, ||, or & chain (e.g. Get-ChildItem && git push); the PowerShell parser previously collapsed these into a single scope.
• When running sandboxed through an ACP client, commands reaching a network host outside the sandbox allow list now surface a permission prompt instead of being silently blocked.
• apply_patch no longer rewrites a whole Windows (CRLF) file’s line endings to LF, so a one-line edit no longer produces a whole-file diff.
• @ file mentions pick up files created, moved, or deleted while the CLI is running instead of showing a stale snapshot from startup.
• Attached images tell the model where the file lives on disk.
• Reverting removes the empty directories Devin created to hold a new file (only ones it created, and only while empty), and /revert no longer ends the session with an “already open in another process” lock error.
• The context window usage indicator appears immediately after resuming an old session, and revert steps are available as soon as a session is reopened.
• The ACP server stays responsive while opening, listing, saving, or updating sessions — persistence runs on a dedicated database thread with a reused connection instead of blocking the async runtime.
• ACP resource links and inline links show the file’s basename on Windows and build well-formed, percent-encoded file:// URIs (file:///C:/Users/you/file.txt) instead of malformed backslash paths.
• Skipping some questions in an ask_user_question will no longer block progress.
• Claude-format hooks that block by exiting with code 2 now take their block reason from stderr, matching Claude Code’s convention.
• The exec tool rejects empty commands with an error instead of silently reporting success, preventing repeated empty-command loops.
• The “Update vX available!” banner will never advertise a version older than the one you’re running.

Added

• MCP servers can now override the RFC 8707 OAuth resource parameter via a new oauthResource field in the MCP server config (or --oauth-resource on devin mcp add / devin mcp login) — needed for identity providers like Microsoft Entra that reject requests containing resource.
• Command hooks now receive the agent’s session id (session_id for Claude-format hooks, trajectory_id for Windsurf-format hooks) and a per-turn id (prompt_id / execution_id) in their stdin payload.

Changed

• Command permission prompts now scope known program runners to the wrapped program: uv run ruff check offers to always allow uv run ruff rather than the much broader uv run. Also applies to poetry run, pdm run, pipenv run, rye run, hatch run, pnpm exec, pnpm dlx, npm exec, yarn dlx, and bun run.
• Sessions now start faster, especially when several reconnect at once.
• The devin migrate command (devin migrate hooks, devin migrate workflows) is now available for migrating from legacy Cascade.
• When the same skill name is loaded from more than one location, each copy now surfaces with a location prefix (/agents:foo, /claude:foo) instead of appearing as indistinguishable duplicates.

Fixed

• Hooks are now discovered in ancestor directories up to the repository root, matching how skills and rules are loaded.
• Improved support for deleting and renaming files with GPT-5.6 models.
• Image-heavy sessions no longer invalidate the provider prompt cache on every request once the trailing-image cap is reached; older images are evicted in batches, reducing token costs and latency in long sessions.
• The CLI no longer leaks a terminal/PTY per tool call: one-shot foreground commands free their shell session as soon as the command finishes, and deliberately retained shells (explicit shell_id, tty, or backgrounded commands) are capped at 16 with least-recently-used eviction.
• Reusing a shell id for a non-interactive command now works instead of failing with “This shell may not be functional”; a busy shell serializes the next command.
• Hooks are now deduplicated by source file, so a hook no longer runs multiple times when the same directory is re-added, workspace directories overlap, or a hook file is reached through a symlink.
• Telemetry: rejected, blocked, or permission-denied tool calls are now recorded with their actual failure reason instead of being mislabelled “turn complete”.

Added

• Added an /mcp slash command with a live MCP server status panel.
• ACU usage is now shown in the /usage command.
• Enterprise login policies are now enforced in the CLI.
• Added a sandbox.excluded allow/ask/deny config (user and team settings) to run specific commands outside the sandbox; excluded commands also skip the sandbox proxy environment.

Changed

• Edits produced in autonomous mode now produce reviewable diffs.
• Skill permissions: frontmatter now applies to auto-approvals.

Fixed

• Fixed command approval parsing for PowerShell $variable assignment prefixes.