Devin CLI · Continuity · Jul 13–19, 2026
1 release · updated
Devin CLI adds oauthResource override
This week, Devin CLI released one update with several changes. The main change is the addition of an oauthResource field, which helps users working with MCP servers and identity providers like Microsoft Entra. This update also includes various fixes and improvements to command hooks, permission prompts, and session management.
v3000.2.17 · July 19, 2026
This release adds a new oauthResource field for MCP servers, command hooks now receive session and turn ids, and includes changes to command permission prompts and session management. Notable fixes include improved hook discovery, support for deleting and renaming files with GPT-5.6 models, and reduced token costs and latency in long sessions. The most notable fix is the improvement in hook discovery, which now matches how skills and rules are loaded.
Official release notes
Added
- MCP servers can now override the RFC 8707 OAuth
resourceparameter via a newoauthResourcefield in the MCP server config (or--oauth-resourceondevin mcp add/devin mcp login) — needed for identity providers like Microsoft Entra that reject requests containingresource. - Command hooks now receive the agent’s session id (
session_idfor Claude-format hooks,trajectory_idfor Windsurf-format hooks) and a per-turn id (prompt_id/execution_id) in their stdin payload.
Changed
- Command permission prompts now scope known program runners to the wrapped program:
uv run ruff checkoffers to always allowuv run ruffrather than the much broaderuv run. Also applies topoetry run,pdm run,pipenv run,rye run,hatch run,pnpm exec,pnpm dlx,npm exec,yarn dlx, andbun run. - Sessions now start faster, especially when several reconnect at once.
- The
devin migratecommand (devin migrate hooks,devin migrate workflows) is now available for migrating from legacy Cascade. - When the same skill name is loaded from more than one location, each copy now surfaces with a location prefix (
/agents:foo,/claude:foo) instead of appearing as indistinguishable duplicates.
Fixed
- Hooks are now discovered in ancestor directories up to the repository root, matching how skills and rules are loaded.
- Improved support for deleting and renaming files with GPT-5.6 models.
- Image-heavy sessions no longer invalidate the provider prompt cache on every request once the trailing-image cap is reached; older images are evicted in batches, reducing token costs and latency in long sessions.
- The CLI no longer leaks a terminal/PTY per tool call: one-shot foreground commands free their shell session as soon as the command finishes, and deliberately retained shells (explicit
shell_id,tty, or backgrounded commands) are capped at 16 with least-recently-used eviction. - Reusing a shell id for a non-interactive command now works instead of failing with “This shell may not be functional”; a busy shell serializes the next command.
- Hooks are now deduplicated by source file, so a hook no longer runs multiple times when the same directory is re-added, workspace directories overlap, or a hook file is reached through a symlink.
- Telemetry: rejected, blocked, or permission-denied tool calls are now recorded with their actual failure reason instead of being mislabelled “turn complete”.
Fan coverage from Devin Central — not an official Cognition announcement. Devin is a trademark of Cognition.
Follow Devin CLI changes
Get Devin CLI changes in the Monday email, with the rest of the week's Devin news.
Prefer a feed reader? Devin CLI RSS feed