Update Air-Gapped Devin Desktop and CLI

This documentation is for the federal deployments of Devin. Back to Devin Docs

The air-gapped Desktop and CLI never update themselves: auto-update is disabled in the Desktop build and devin update is disabled in the CLI. Every update is a new bundle that you download from the portal, verify, and install on each workstation, following the same process as the first install. This page covers what is different the second time around.

How a new version appears

The portal’s Install → Air-gapped downloads page (windsurf.fedstart.com/install/airgap) serves exactly one release at a time. The version is shown in the Downloads heading (for example version 1.66.101 (0123abcdef)), and the SHA-256 checksum of each file is shown through the Show checksum control next to it. When Cognition releases a new air-gapped build to your portal, the page starts serving the new version and checksums in place of the old ones; there is no version picker and no notification. To track releases, check the version label on the downloads page as part of your regular maintenance cycle.

Step 1: Check what you are running

On a workstation, compare the installed CLI version with the version shown on the downloads page:

devin --version

devin-federal <version>+airgap.<sha>

devin --version prints the release version and the short commit of the build. Desktop and its bundled CLI are built from the same commit, so this version applies to both.

Step 2: Download and verify the new bundle

Follow Step 1 and Step 2 of the install guide for the new version: download the package for each platform in your fleet, record the checksum from the portal page, transfer the files across the air gap, and confirm the SHA-256 matches before installing. Checksums change with every release. Record the new value from the portal page when you download; do not reuse a checksum from a previous version.

Step 3: Install over the existing version

Quit Desktop and stop any running devin sessions on the workstation first. Configuration, session history, the audit log, and SSO logins are stored outside the application (see On-disk formats) and are preserved across the update.

macOS
Linux (.deb / .rpm)
Linux (.tar.gz)
Windows (installer)
Windows (.zip)

Open the new .dmg and drag Devin - Airgap into /Applications, replacing the existing application when prompted. Then verify the signature as in Step 3 of the install guide:

spctl --assess --type execute --verbose "/Applications/Devin - Airgap.app"

/Applications/Devin - Airgap.app: accepted
source=Notarized Developer ID

sudo dpkg -i Devin-linux-x64-<new-version>.deb   # Debian/Ubuntu
sudo rpm -U Devin-linux-x64-<new-version>.rpm    # RHEL/Fedora

dpkg -i upgrades an installed package in place; use rpm -U (not rpm -i) so rpm replaces the installed version instead of refusing the install. There is no apt or yum repository for air-gapped builds.

Move the old extraction aside, then extract the new archive to the same location so the launcher path (/opt/Devin-linux-x64/bin/devin-airgap) and any PATH entry for the bundled devin binary stay valid:

sudo mv /opt/Devin-linux-x64 /opt/Devin-linux-x64.previous
sudo tar -xzf Devin-linux-x64-<new-version>.tar.gz -C /opt

Remove /opt/Devin-linux-x64.previous once the new version is validated.

Verify the Authenticode signature of the new installer as in Step 3 of the install guide, then run it as an administrator:

Get-AuthenticodeSignature .\DevinSetup-x64-<new-version>.exe | Format-List Status, SignerCertificate

The air-gapped build has no update URL; a new installer is the only upgrade path for an installed copy.

Unpack Devin-win32-x64-<new-version>.zip to its own folder, verify the signature of the unpacked executables as in Step 3 of the install guide, and run Desktop from the new folder.Remove the previous folder once the new version is validated, and update any PATH entry for the bundled devin.exe.

The license file, models file, and auth file under /etc/devin/ (C:\ProgramData\Devin\ on Windows) are not part of the package and are not touched by an update.

Step 4: Validate the update

On each updated workstation, run as a normal user:

devin --version
devin airgap doctor

devin-federal <new-version>+airgap.<sha>
pass  license                                seat alice@example.gov (account acme), expires 2027-03-01
...
10 check(s): 10 passed, 0 warning(s), 0 failure(s)

Then launch Desktop once and confirm it opens a session against your model endpoint. Two update-specific failures to watch for:

Symptom	Cause	Action
`LIC004` immediately after the update	The new build embeds a rotated set of public keys and your license was signed with a key the build no longer trusts.	Issue a new license from the portal and replace the file as described in Renew or replace a license. Run the `kid` check to confirm.
An `MDL` code on a models file that validated before	The new release changed models-file validation.	Run `devin models validate`; the diagnostic names the field and the code. See Models file.

Every session_start audit record carries the cli_version, so your SIEM can confirm the rollout: sessions from an updated workstation report the new version.

Rolling back

Keep the previous version’s package and checksum until the new version is validated across the fleet. Rolling back is the same procedure as installing: verify the checksum of the older package and install it over the newer one. On RPM systems add --oldpackage, because rpm -U otherwise refuses to replace a newer version with an older one:

sudo rpm -U --oldpackage Devin-linux-x64-<previous-version>.rpm

Release notes

Release notes for air-gapped builds are published alongside the other Devin release notes in Recent Updates. Before rolling out a new version, read the entry for it and look in particular for changes to the on-disk formats or audit-log schema (the schema_version value), new or changed error codes, and any license key rotation that requires re-issuing licenses.

​How a new version appears

​Step 1: Check what you are running

​Step 2: Download and verify the new bundle

​Step 3: Install over the existing version

​Step 4: Validate the update

​Rolling back

​Release notes

How a new version appears

Step 1: Check what you are running

Step 2: Download and verify the new bundle

Step 3: Install over the existing version

Step 4: Validate the update

Rolling back

Release notes