Devin CLI Updates & Release Notes

Added

• devin auth status now shows the primary organization for enterprise accounts.
• Nested AGENTS.md files, lowercase agents.md files, and rules in supported dot-directories are now discovered and remain scoped to the directory where they apply.
• Completed ask_user_question prompts now appear as /steps entries that you can revert to or fork from. Reverting to a question asks it again.
• Press Esc twice within three seconds to interrupt a running turn; Ctrl+C still interrupts on the first press.

Removed

• We have removed the shell integration feature. It was in preview and we have decided not to make it generally available. Use devin shell remove to clean up old integration blocks.

Changed

• Slash-command completion descriptions now appear for every result in a consistent aligned column.
• /add-dir now checks workspace trust before attaching an untrusted directory, makes attached directories writable in the OS sandbox, and revokes that access when they are removed. Skills from attached directories also appear immediately in slash-command completion.
• Plugin installation now uses personal plugins by default, syncing to Devin Cloud and other devices; use --local for a device-only install.
• All devin plugins commands now require login, and plugin MCP servers discovered after a workspace root is attached or first touched now register correctly.
• Permission denials now identify the layer responsible.
• Plan mode now uses the normal permission system, and “always allow” choices appear only when they can take effect.
• ACP session persistence and resume now restore titles, modes, and usage totals consistently. /continue resolves the most recent session, /fork defaults to the latest step, and ACP revert can cancel an active turn before rewinding.
• /fast now selects SWE-1.7 Lightning when available, falling back to SWE-1.6 Fast or other fast models.
• Quota-exhaustion messages now link to usage settings for on-demand usage and auto-reload.

Fixed

• Ensured ask_user_question requests now use standard ACP elicitation so third-party clients like Zed can answer them.
• Large-file reads through ACP are bounded and paginated instead of repeatedly rereading overflow files. Late terminal flushes now preserve complete output and cannot reopen completed command cards.
• Model refusals now show a warning instead of silently ending a turn, and image prompts continue to inference after captioning completes.
• Resuming, continuing, or reverting a session no longer duplicates workspace context, and skill invocations can be repeated after a session restart.
• Non-UTF-8 command output is reported with the real output and exit code.
• Linux sandbox startup no longer hangs while expanding filesystem globs; unsupported glob rules are ignored and logged, while trailing /** continues to cover a directory tree.
• Notebook edits now change only the target cell and preserve unrelated metadata, outputs, attachments, ids, and fields.
• Uninstalling a plugin also removes and stops its MCP servers, and plugin registries are now flushed safely before replacement so crashes cannot erase them.
• Shell commands blocked on a sudo password prompt now fail fast with an explanation instead of hanging.
• Smart mode and other flag-gated features now refresh immediately when authentication or team context changes.

Added

• New smart permission mode: workspace edits auto-approve like Accept Edits, and a fast model decides whether other actions (shell commands, fetches, out-of-workspace writes) are safe to auto-run, falling back to the normal prompt otherwise. Auto-approval is limited to routine development work (building, testing, linting) — package installs, downloads that execute code, mutating git, rm, sudo, kubectl delete, cloud CLIs, and anything destructive always prompt, as do sensitive paths (dotenv, key material, Git config, agent configuration). Switch with /smart, /mode smart, --permission-mode smart. Available in all builds, off unless the server-side rollout flag is enabled for your client.
• Plugins can now contribute rules, hooks, MCP servers, and custom subagents, not just skills. Plugin AGENTS.md / AGENT.md / .windsurfrules load as always-on rules, hooks.json loads alongside project hooks, MCP servers declared via a root .mcp.json or an inline manifest mcpServers map run for the session, and agents//AGENT.md files surface as : subagent profiles. devin plugins info and the install trust prompt list all of them before you confirm, and devin rules list / devin mcp list include them.
• New plugin sources and manifest options: the git-subdir source kind installs a plugin living in a subdirectory of a shared repo (devin plugins install acme/vendor-plugins#plugins/stripe), a skills manifest field controls where skills load from (or disables them with []), and a Claude-compatible .claude-plugin/plugin.json manifest is used when no .devin-plugin/plugin.json is present.
• MCP prompts support: prompts offered by connected MCP servers are available as /mcp____ slash commands, with arguments mapped positionally onto the prompt’s declared arguments.
• Editable command approvals: the shell-command permission prompt now offers “Edit command” to tweak the proposed command inline before approving, and “Describe change to command” to have a fast model rewrite it in plain language (out-of-band — nothing enters the conversation) for review. ACP clients get the same affordances.
• Command permission prompts now offer a global “Yes, always allow commands in all projects” option saved to the user-level config.json, alongside the existing per-project option. Web-fetch prompts gained an equivalent “always allow all web fetches” option.
• Configurable keybindings via a keymap section in config.json, keyed by context then action (e.g. { "keymap": { "global": { "clear_screen": "ctrl-shift-k" } } }). /shortcuts now lists every binding across all contexts, shows each action’s context.action identifier, and lets you rebind interactively. Ctrl+C cannot be unbound.
• Copilot agent skills are discovered automatically from .github/skills/ and ~/.copilot/skills/, toggled with the copilot key under read_config_from.
• New subagents_enabled setting in config.json (on by default) turns the run_subagent / read_subagent tools off; changes apply live to the running session.
• In plan mode, a megaplan keyword (megaplan, ultraplan, masterplan) triggers extra planning guidance: the agent plans more extensively and always asks at least one clarifying question before writing the plan.
• Old log files are gzip-compressed on startup — logs from finished processes untouched for 48 hours become .log.gz (still searchable with zgrep / rg -z).
• Administrators can configure the CLI’s outbound HTTP proxy through the MDM-distributed enterprise policy file (system.json); it takes precedence over the user config, and the updater honors it too.
• devin acp --model (or DEVIN_MODEL) sets the default model for every session the ACP server creates, matched the same way /model matches it.
• devin acp --cloud (insiders) relays the ACP connection to Devin cloud instead of running the local agent.
• /btw, /loop, /mcp, /context, /add-dir, /undo-add-dir, /workspace are now advertised as agent-side ACP slash commands, so any ACP client (Devin Desktop, JetBrains, or Zed) can invoke them and their progress streams back as session updates. /remove-dir and /workspaces were added as second names for /undo-add-dir and /workspace.

Changed

• MCP servers now live in dedicated config files — ~/.config/devin/mcp_config.json (%APPDATA%\devin\mcp_config.json on Windows), .devin/mcp_config.json, and .devin/mcp_config.local.json — instead of the mcpServers key of config.json. Existing mcpServers entries in config.json are migrated automatically on startup. See MCP Configuration.
• Shell commands run by the agent now inherit your login shell’s environment (.bashrc / .zshrc / .zprofile / fish config), so nvm, pyenv, rbenv, direnv, and custom PATH entries just work. Snapshotted once per session; macOS/Linux only.
• Plan mode now allows read-only MCP tools (those annotated readOnlyHint: true) plus listing MCP servers, tools, and resources, so the agent can gather context while planning.
• Relative plugin references (./path) in manifests and repo plugin configs now resolve against the entity that declares them rather than the process working directory — including forbiddenPlugins deny entries, which previously matched nothing. Manifests with unresolvable relative references now fail to parse instead of carrying a silently dead entry.
• Organization sandbox enforcement now applies to running sessions: team settings are refreshed at each prompt, and turning on required sandboxing mid-session refuses further prompts with a message asking you to restart.
• /session-stats renders every usage dimension the server reports — credits, ACUs, agent messages, turn continuations, token usage — using the server’s own labels and grouping, the Model row names the model that actually served the billed turns, and totals persist across resume.
• Automatic context compaction is no longer surfaced in the scrollback or the ACP conversation view; an explicit /compact still confirms in the transcript.

Fixed

• Interrupting the agent now pauses running subagents instead of leaving them working in the background: they park with their state intact and resume on your next message. Subagent activity also survives a session reload, and a subagent’s approval prompt now shows the command and names the requesting subagent.
• Sending a queued message immediately (Enter on an empty input while Devin is working) actually interrupts the current turn instead of leaving the message queued until the turn finished.
• Exiting plan mode now injects an explicit mode-change announcement, so the agent reliably starts acting in the new mode instead of continuing to follow plan-mode restrictions from earlier in the conversation.
• Permission rules with recursive globs (e.g. deny: ["Read(/etc/**)"]) now also cover the base directory itself.
• On Windows, Deny rules now block a forbidden command hidden behind a safe leading command in a &&, ||, or & chain (e.g. Get-ChildItem && git push); the PowerShell parser previously collapsed these into a single scope.
• When running sandboxed through an ACP client, commands reaching a network host outside the sandbox allow list now surface a permission prompt instead of being silently blocked.
• apply_patch no longer rewrites a whole Windows (CRLF) file’s line endings to LF, so a one-line edit no longer produces a whole-file diff.
• @ file mentions pick up files created, moved, or deleted while the CLI is running instead of showing a stale snapshot from startup.
• Attached images tell the model where the file lives on disk.
• Reverting removes the empty directories Devin created to hold a new file (only ones it created, and only while empty), and /revert no longer ends the session with an “already open in another process” lock error.
• The context window usage indicator appears immediately after resuming an old session, and revert steps are available as soon as a session is reopened.
• The ACP server stays responsive while opening, listing, saving, or updating sessions — persistence runs on a dedicated database thread with a reused connection instead of blocking the async runtime.
• ACP resource links and inline links show the file’s basename on Windows and build well-formed, percent-encoded file:// URIs (file:///C:/Users/you/file.txt) instead of malformed backslash paths.
• Skipping some questions in an ask_user_question will no longer block progress.
• Claude-format hooks that block by exiting with code 2 now take their block reason from stderr, matching Claude Code’s convention.
• The exec tool rejects empty commands with an error instead of silently reporting success, preventing repeated empty-command loops.
• The “Update vX available!” banner will never advertise a version older than the one you’re running.

Added

• MCP servers can now override the RFC 8707 OAuth resource parameter via a new oauthResource field in the MCP server config (or --oauth-resource on devin mcp add / devin mcp login) — needed for identity providers like Microsoft Entra that reject requests containing resource.
• Command hooks now receive the agent’s session id (session_id for Claude-format hooks, trajectory_id for Windsurf-format hooks) and a per-turn id (prompt_id / execution_id) in their stdin payload.

Changed

• Command permission prompts now scope known program runners to the wrapped program: uv run ruff check offers to always allow uv run ruff rather than the much broader uv run. Also applies to poetry run, pdm run, pipenv run, rye run, hatch run, pnpm exec, pnpm dlx, npm exec, yarn dlx, and bun run.
• Sessions now start faster, especially when several reconnect at once.
• The devin migrate command (devin migrate hooks, devin migrate workflows) is now available for migrating from legacy Cascade.
• When the same skill name is loaded from more than one location, each copy now surfaces with a location prefix (/agents:foo, /claude:foo) instead of appearing as indistinguishable duplicates.

Fixed

• Hooks are now discovered in ancestor directories up to the repository root, matching how skills and rules are loaded.
• Improved support for deleting and renaming files with GPT-5.6 models.
• Image-heavy sessions no longer invalidate the provider prompt cache on every request once the trailing-image cap is reached; older images are evicted in batches, reducing token costs and latency in long sessions.
• The CLI no longer leaks a terminal/PTY per tool call: one-shot foreground commands free their shell session as soon as the command finishes, and deliberately retained shells (explicit shell_id, tty, or backgrounded commands) are capped at 16 with least-recently-used eviction.
• Reusing a shell id for a non-interactive command now works instead of failing with “This shell may not be functional”; a busy shell serializes the next command.
• Hooks are now deduplicated by source file, so a hook no longer runs multiple times when the same directory is re-added, workspace directories overlap, or a hook file is reached through a symlink.
• Telemetry: rejected, blocked, or permission-denied tool calls are now recorded with their actual failure reason instead of being mislabelled “turn complete”.

Added

• Added an /mcp slash command with a live MCP server status panel.
• ACU usage is now shown in the /usage command.
• Enterprise login policies are now enforced in the CLI.
• Added a sandbox.excluded allow/ask/deny config (user and team settings) to run specific commands outside the sandbox; excluded commands also skip the sandbox proxy environment.

Changed

• Edits produced in autonomous mode now produce reviewable diffs.
• Skill permissions: frontmatter now applies to auto-approvals.

Fixed

• Fixed command approval parsing for PowerShell $variable assignment prefixes.

Added

• Subagents can now be configured with a default model.
• Added an attribution option to the Devin Local config file; set it to false to suppress Devin mentions in commit messages.

Changed

• The MCP registry cache is now warmed during startup, so MCP servers are ready sooner.

Fixed

• On Windows, bash now resolves to Git Bash instead of the WSL launcher stub.
• Injected context is no longer included in auto-generated session titles.
• Fixed full-width wrapping of CLI question replies.

Plugins

Install bundles of skills from a GitHub repo, a git URL, or a local folder, and share them across projects. A plugin is any source containing a .devin-plugin/plugin.json manifest and a skills/ directory; its skills become available as /<plugin>:<skill>. A plugin can require other plugins (installed automatically), endorse optional ones, and forbid others — so a plugin can act as a curated, governed collection. Plugins are in beta and opt-in for enterprises, so behavior and configuration may change in future releases. See the plugins overview for details.

Enterprise controls

Expanded controls for admins to govern what Devin Local can do and which tools it can reach.

• Teams can define terminal command allow/deny lists, enforced through CLI permission scopes with exact-command matching and * wildcards.
• Org-level control to disable Devin CLI plugins: when set, the CLI refuses to install or update plugins and skips the skills from any installed plugins.
• The “Disable CLI access” team setting is now enforced for Devin Local (the CLI hosted in Windsurf), including the bundled agent registry and the allowed-MCP-server allowlist.

Added

• devin plugins install <source> installs a plugin (and its required plugins) from a GitHub owner/repo, a git URL, or a local path.
• devin plugins list shows installed plugins with their version and whether they are currently blocked by policy.
• devin plugins info <plugin> shows the skills a plugin provides and its required, optional, and forbidden lists.
• devin plugins update [plugin] re-fetches a plugin (or all plugins) at the latest version; local plugins are linked to their source folder so edits are live without re-installing.
• devin plugins remove <plugin> uninstalls a plugin, leaving any auto-installed required plugins in place.
• forbiddenPlugins entries accept glob patterns (e.g. acme/*, /secrets, https://gitlab.com/acme/) in addition to exact identities and the lone * lockdown.

Changed

• Improved authentication in third-party ACP clients, including JetBrains and Zed: both browser and manual sign-in now use the Devin auth flow, so the manual /login fallback works where it previously failed.