Devin CLI: Read-only tools allowed by default

Read-only tools allowed by default

Read-only tool calls (file reads, grep, glob, thinking) are now always allowed and no longer surface a permission prompt. User-, project-, and organization-configured deny rules still take precedence, so you can still restrict reads to sensitive paths.

.devin/hooks.v1.json support

Define pre- and post-command hooks in a standalone .devin/hooks.v1.json file using the same format as Claude Code hooks.

devin mcp add overhaul

devin mcp add now matches Claude Code’s syntax: positional URL argument (e.g. devin mcp add notion https://mcp.notion.com/mcp), inferred transport from --url (HTTP) or trailing args (stdio), default scope changed from user to local (writes to .devin/config.local.json, gitignored), and new short flags (-t, -s, -e, -H).

Agent mode and permission mode separation

Agent profiles (normal, plan, ask) and permission modes (normal, accept edits, bypass, autonomous) are now two independent controls. Profiles are switched via /plan, /ask, /normal slash commands. /plan <prompt> switches to plan mode and immediately sends the prompt in one step. Permission modes are cycled with Shift+Tab or /mode.

Live streaming tool previews

Tool calls now appear immediately as arguments stream in, showing structured titles and content (diffs for edits, code blocks for writes, commands for exec) instead of waiting for the full request.

Terminal notifications

The CLI now sends terminal notifications when the agent finishes, needs input, or requests tool approval. Triggers dock badge and notification banners in supported terminal emulators. Controlled by the notify config option: "never", "smart" (default, only when unfocused), or "always".

Added

• Added structured form-based input support when connected to ACP clients that advertise elicitation capability.

• Added inference tool name metadata to ACP tool call events so ACP clients can make per-tool presentation decisions (for example, hiding the arguments panel for internal tools).

• Enabled the devin acp subcommand on stable and next, so any released build of Devin for Terminal can be launched as an Agent Client Protocol server by ACP-aware editors.

• Added /ask, /compact, /context, and /undo-add-dir slash commands for ACP clients (e.g. JetBrains).

• Expanded /help output in ACP sessions to list all built-in commands and discovered skills.

• Show subagent activity and lifecycle events in the Windsurf UI.

• Made the “Mode:” and “Model:” labels in the footer clickable to open their selector menus

• Added mouse support to selector menus: click to select, scroll wheel to navigate, hover to highlight

• Autocomplete for /continue and /rm-session commands showing recent sessions with ID prefix, time ago, and title.

• --force flag on devin update and /update to force re-install even when already on the latest version.

• Added interactive OAuth support for MCP servers — when an MCP server requires authentication, the browser opens automatically and a status message appears in the REPL.

• /new as an alias for /clear to start a fresh conversation.

• Active permission level in the top border of the input box.

• Thumbs up/down feedback for agent responses via Alt+↑/Alt+↓ and /feedback.

• respect_gitignore config option to control whether the agent respects .gitignore when accessing files via tools (default: off). Separate from include_gitignored_files, which only affects @ tab completion.

• /resume as an alias for /ls (list recent sessions).

• Subagent prompt in the expanded view (Ctrl+O) when a subagent completes.

• Live streaming of subagent actions while waiting on a foreground subagent or a read_subagent call.

• /session-stats command to display cumulative session statistics (tool calls, files changed, commands run, tokens, model, request ID).

Changed

• Changed workspace directory updates via ACP to use replacement semantics, enabling directory removal through the config option.

• Made /ask <question> a one-shot command matching REPL behavior: temporarily switches to Ask mode, submits the question, then restores the previous mode.

• Made session troubleshooting easier in Windsurf by showing diagnostic logs directly in the output panel.

• Presented related agent questions in a single paginated form instead of one at a time.

• Improved the plan mode exit approval with a dedicated review UI showing the plan summary and contextual button labels.

• Improved Windsurf hook scripts to receive richer tool information on stdin, including edit details, MCP tool results, and assistant responses

• devin mcp add no longer requires --transport or --command for the common stdio case — transport is inferred from --url (HTTP) or trailing args (stdio), and the first trailing arg is used as the command when --command is omitted

• /mode now opens an interactive dropdown selector (like /model) instead of printing a static list. Use arrow keys to navigate, Enter to confirm, Esc to cancel.

• -p/--print now accepts an optional inline prompt, so devin -p "fix the bug" works without needing the -- separator. The old devin -p -- fix the bug syntax continues to work.

• Shortened the “always allow” label for command permission prompts to “Always allow <cmd> commands in <workspace>”, where <workspace> is just the last path element of the workspace directory, so it no longer overflows narrow terminals or ACP client UIs when the workspace path is long.

• /mode now opens an interactive dropdown selector (like /model) instead of printing a static list. Use arrow keys to navigate, Enter to confirm, Esc to cancel.

• Plan mode exit approval now has a dedicated review UI showing the plan summary and contextual button labels.

• Removed the brand colors from the startup logo so it uses the terminal’s default foreground color.

• Truncation notices now include a “(ctrl+o to expand)” hint.

• Consolidated the mode and permission pickers into a single unified mode selector in Windsurf. The available modes are now Code, Ask, Plan, Accept Edits, and Bypass Permissions.

• Each Devin CLI channel now reads Windsurf config (MCP servers, skills) from its matching channel-specific directory under ~/.codeium/

Fixed

• Fixed ACP sessions to require host-provided credentials instead of silently falling back to local CLI credentials, ensuring usage is properly attributed to the correct account.

• Preserved streamed shell command output in ACP chat UIs so it stays visible after the command completes, with the exit code shown alongside instead of replacing the output.

• Session mode selector now updates immediately after choosing “switch to accept edits” from a permission prompt.

• Skipping a tool call in Windsurf no longer stops the agent — the LLM now sees the rejection and can try an alternative approach

• Tool failure messages now show the error reason in Windsurf instead of just “Failed” with no explanation.

• Fixed /add-dir and /undo-add-dir failing to handle directory paths containing spaces. Slash command arguments are now parsed with shell-style quoting (e.g. /add-dir "my dir" or /add-dir my\ dir), and tab completions automatically escape spaces in directory names.

• Fixed excessive line spacing in the ASCII mode startup banner.

• Long-running shell commands like dev servers now start reliably without blocking subsequent work.

• Fixed bypass mode not auto-approving MCP read_resource, computer use, recording, and browser tools due to incorrect permission scopes.

• Fixed autonomous mode silently auto-approving privacy-sensitive tools (computer use, recording, browser) that operate outside the OS sandbox.

• Fixed browser screenshot path authorization mismatch when the screenshots directory was relative.

• Fixed wide character (CJK/emoji) display corruption when deleting characters adjacent to them.

• Fixed “always allow” for command permissions silently failing to persist when running outside a git repository.

• Improved text visibility when the terminal background doesn’t match the selected color theme.

• Fixed alphabetic sorting in directory completion menus so that shorter directory names sort before longer ones that share the same prefix (e.g., devin/ now correctly appears before devin-docs/).

• Shell command output is no longer lost after long terminal sessions with extensive scrollback.

• Fixed injected lint diagnostics appearing as fake user messages when reopening a saved session.

• Fixed an issue where the agent would not automatically review and fix lint errors detected after code edits.

• Improved lint error presentation with more detailed information including severity level, source, and precise location.

• Added a safety cap on lint-fix injection count to prevent infinite loops when a lint cannot be resolved.

• Separated new and persistent lint errors with distinct instruction text so the agent understands which lints it has seen before.

• ANSI color escape codes are no longer written to log files or piped stdout/stderr. Colored output is only emitted to real terminals and respects the NO_COLOR environment variable.

• Mode is now properly restored on session resume.

• Session resume no longer drops early conversation messages after multiple compaction rounds.

• Permission mode no longer resets unexpectedly mid-session.

• Sandbox sessions no longer revert from autonomous to normal mode when exiting plan mode.

• Code diffs and other rich tool call content no longer disappear from edit/write tool calls after reloading a session in the replay UI.

• shell run no longer leaves the terminal in a bad state after exit.

• Fixed silent crashes when a corporate proxy or firewall resets a network connection mid-session.

• Ctrl+C now exits quickly even when the network connection is slow or stalled.

• Session and always-allow choices in permission prompts now work correctly for terminal commands that also write files.

• Thinking output now always renders before content when a model skips the ThinkingComplete event

• Malformed tool-call error messages now point to the specific field and expected value type.

• Windows no longer shows double authentication prompts during initial setup.

• Windows installer now places files in the correct directory so PATH resolves properly.

• Windows config file location is now clearly documented as %APPDATA%\devin\config.json instead of ~/.config/devin/config.json.

• Grep now searches hidden files like .env and .github/, matching the behavior of rg --hidden. The .git/ directory remains excluded.

• Large images (over 5 MB) no longer fail to send.

• Local shell commands no longer continue running in the background after a session is interrupted or cancelled.

• Preserved rich mention rendering (e.g. @README.md chips) when resuming a session, instead of showing raw markdown text.

Removed

• Removed the in-REPL overage status indicator banner
• “Thought for Xs” duration display no longer appears in the REPL scrollback.

Removed

• In-REPL overage status indicator banner is no longer shown.

Added

• Warning when your account is in overage so you know requests are being billed to your team’s prepaid balance.
• /usage command to show Windsurf credits and ACUs consumed during the current session.

Fixed

• The installer now accepts existing ~/.local/bin/devin symlinks pointing to the legacy ~/.local/share/cognition/cli/... path and refreshes them correctly after the cognition-to-devin migration.