0.9.0 — Devin CLI is the fourth agent kind

0.9.0 — Devin CLI is the fourth agent kind

OpenACA now inventories Devin CLI alongside Claude Code, Cursor and Codex, in
both scan repo and scan endpoint. Devin reads formats OpenACA already
parses (the mcpServers map, SKILL.md, Claude Code's hook event names, Claude
Code and Agent Plugins manifests) and by default imports MCP servers, skills
and hooks from several other runtimes. Most of this release is reuse; most of
its commits are about attribution: which files are Devin's evidence, and
which are only its composition.

Design: ADR-0070 through ADR-0074, docs/specs/devin-cli-agent-kind.md.

Highlights

• devin-cli is a registered agent kind. Repo evidence is Devin's own
  files (.devin/mcp_config.json, .devin/config.json, .devin/hooks.v1.json,
  .devin/skills/, .devin/agents/, .devin-plugin/plugin.json) plus the
  shared .agents/skills and .agents/agents directories (ADR-0072). Endpoint
  scans read $XDG_CONFIG_HOME/devin (else ~/.config/devin) and the plugin
  store under $XDG_DATA_HOME/devin/cli. Coverage is partial at both
  sources: managed plugins, ACP-registered MCP servers and a user's
  read_config_from are not observable (ADR-0070).

• Imported surfaces are composition, never evidence. MCP servers, skills
  and hooks Devin imports from other runtimes are composed into the Devin graph
  under the root that owns them, so a repo holding only another runtime's files
  is not reported as a Devin repo. Same-named imported and native MCP servers
  are both recorded. Skill imports follow the paths Devin actually reads,
  including home-directory Claude Code skills, and a layered skill's
  provenance is looked up in its own layer's lock.

• Devin plugins follow Devin's loader rules. .devin-plugin,
  .claude-plugin and portable Agent Plugins manifests resolve in Devin's
  precedence. A .devin-plugin manifest Devin would reject is reported as a
  coverage gap instead of silently falling back to another manifest. A
  plugin's skills field may be a list and replaces the default directory
  ([] disables skills; one invalid entry voids the whole declaration);
  mcpServers selects MCP sources; Devin plugins have no commands surface and
  may define directory-form agents. Plugins named in requiredPlugins are
  inventoried with the identity their source pins, so a GitHub-sourced plugin
  pinned to a tag or commit is matchable against advisories. A root Agent
  Plugins plugin.json is evidence for every kind that reads it (ADR-0074).
  Store plugins are presence-only, from lock.json.

• Devin permissions are reported under two existing rule ids. One
  permissions list approves both shell commands and MCP tools, so it is split
  by entry: Exec(…) and bare exec allows report under
  openaca-posture-command-policy-allow, mcp__… allows under
  openaca-posture-mcp-auto-approve. Lists merge across user, project and
  project-local levels first; a covering deny anywhere in an allow's chain, or
  a covering ask at a higher-precedence level, suppresses it (ADR-0073).

• Posture rules learn Devin's spellings. Devin's exec shell tool counts
  for openaca-posture-skill-executable-tool and maps to the shell_exec
  capability; Devin's serverUrl alias is recognised when recovering MCP
  header credentials; a path-shaped ${file:/path} header is read as a
  reference, not a literal credential.

• --config-dir is refused for --kind devin-cli (ADR-0071). An installed
  Devin composes from four root groups, and overriding only the config root
  would produce a composition stitched from two homes that looks like a
  correct scan.

• Parser additions. The hooks parser reads a file whose envelope is the
  whole file (Devin's hooks.v1.json), rejecting a Claude-style wrapper in
  strict mode; the JSONC loader posture kept private is now shared as
  tools/parsers/jsonc.py.

Install

uv tool install openaca==0.9.0 or pip install openaca==0.9.0.

Compatibility

Pre-V0 — no back-compat hedging.

• Repos with shared directories gain a devin-cli target. A repo
  containing .agents/skills/, .agents/agents/ or a root Agent Plugins
  plugin.json now reports a Devin CLI target in addition to the Cursor and
  Codex targets it reported before. Consumers iterating agents in JSON
  output, or the per-target sections in text output, see an extra entry.

• ${file:/path} headers no longer fire
  openaca-posture-mcp-header-credential, for any kind. Only a path-shaped
  body counts as a reference; a token wrapped in the syntax, or a literal
  beside a reference, is still reported.

• exec in a skill's allowed-tools is kind-scoped. It maps to
  shell_exec and fires the executable-tool posture rule under a Devin scan
  or an unscoped call only; a Cursor or Codex scan of the same shared skill is
  unchanged.

• command-policy-allow and mcp-auto-approve take active_in from the
  scanning agent rather than hardcoding the first kind that used them.

• tools.parsers.agent_plugins.manifest_schema_version is removed. It had
  no remaining callers.

• BOM schema version stays 0.5. tools/bom.py and tools/graph_build.py
  changed, but only to pass the agent kind into capability annotation and to
  compose Devin's surfaces: no component types, properties or dependency-edge
  shapes were added, and openaca:agent_kind is a free-form string that
  already admits devin-cli. schema/openaca-bom.schema.json is untouched.

• The overlay record schema is unchanged.