Install Air-Gapped Devin Desktop

This documentation is for the federal deployments of Devin. Back to Devin Docs

This page walks you through a first install of the air-gapped Devin Desktop bundle, which includes the air-gapped Devin CLI. Complete it on one workstation first, then repeat for your fleet using your approved media process.

Before you begin

You are signed in to the portal as an approved member of a team with an active on-prem entitlement. Without the entitlement the air-gapped downloads page reports that you are not eligible; contact your account team.
You have prepared, or are ready to prepare, the two files every host needs before first launch:
- a license file, issued from the portal (see License);
- a models file describing your model endpoints (see Models file).
The target host runs a supported platform: macOS (Apple silicon or Intel), Linux (x86_64 or aarch64), or Windows (x64 or arm64).

Step 1: Download the bundle from the portal

In the portal, open Install → Air-gapped downloads (windsurf.fedstart.com/install/airgap).
Choose the Devin Desktop installer for the target platform. The page lists one package per platform and format:
Platform Formats
macOS, Apple silicon .dmg
macOS, Intel .dmg
Linux x64 .deb, .rpm, .tar.gz
Linux arm64 .deb, .rpm, .tar.gz
Windows x64 .exe (system installer), .zip
Windows arm64 .exe (system installer), .zip
The Windows files are named DevinSetup-<arch>-<version>.exe and Devin-win32-<arch>-<version>.zip, where <arch> is x64 or arm64. The installer installs for all users; there is no per-user installer.
Note the SHA-256 checksum the page shows next to the file (use Show checksum). You will compare against it after transfer.
Transfer the file into the air-gapped environment by your approved media process.

Platform	Formats
macOS, Apple silicon	`.dmg`
macOS, Intel	`.dmg`
Linux x64	`.deb`, `.rpm`, `.tar.gz`
Linux arm64	`.deb`, `.rpm`, `.tar.gz`
Windows x64	`.exe` (system installer), `.zip`
Windows arm64	`.exe` (system installer), `.zip`

The same page offers two further downloads, each with its own SHA-256 checksum:

Download	File	Purpose
Desktop tunnel CLI	`Devin-cli-linux-x64-<version>.tar.gz`, `Devin-cli-linux-arm64-<version>.tar.gz`	The standalone `devin-desktop-airgap` command-line tunnel for connecting Desktop to a remote host over SSH. Install it on the remote machine, not the workstation.
Remote extension host	`devin-reh-linux-<arch>-<version>.tar.gz`, `devin-reh-darwin-<arch>-<version>.tar.gz`	The server component Desktop installs on SSH targets. Stage it for hosts that cannot fetch it themselves.

The Devin agent CLI (devin) is not one of these downloads: it ships inside every Desktop package (see Step 5).

Step 2: Verify the checksum

On the target host (or before crossing the air gap), compute the SHA-256 of the downloaded file and compare it with the value shown in the portal.

macOS
Linux
Windows

shasum -a 256 Devin-darwin-arm64-<version>.dmg

3f6c…e21a  Devin-darwin-arm64-<version>.dmg

sha256sum Devin-linux-x64-<version>.deb

3f6c…e21a  Devin-linux-x64-<version>.deb

Get-FileHash -Algorithm SHA256 .\DevinSetup-x64-<version>.exe

The Hash value must match the checksum on the portal page; Get-FileHash prints it in upper case, so compare without regard to case.

The first column must match the checksum on the portal page exactly. If it does not, discard the file and download it again.

Step 3: Install

macOS
Linux (.deb / .rpm)
Linux (.tar.gz)
Windows (installer)
Windows (.zip)

Open the .dmg and drag Devin - Airgap into /Applications.
Verify the code signature and notarization before first launch:
spctl --assess --type execute --verbose "/Applications/Devin - Airgap.app" codesign --verify --deep --strict "/Applications/Devin - Airgap.app"
/Applications/Devin - Airgap.app: accepted source=Notarized Developer ID
spctl prints accepted; codesign --verify prints nothing and exits 0 when the signature is intact. Any rejected or code object is not signed at all output means the bundle was altered in transit: discard it and start again from Step 1.

sudo dpkg -i Devin-linux-x64-<version>.deb   # Debian/Ubuntu
sudo rpm -i Devin-linux-x64-<version>.rpm    # RHEL/Fedora

There is no apt or yum repository for air-gapped builds; install and upgrade from the package files directly.

sudo tar -xzf Devin-linux-x64-<version>.tar.gz -C /opt

The launcher is /opt/Devin-linux-x64/bin/devin-airgap.

Verify the Authenticode signature of the installer before running it:
Get-AuthenticodeSignature .\DevinSetup-x64-<version>.exe | Format-List Status, SignerCertificate
Status must be Valid and the signer certificate must be issued to Exafunction, Inc. With the Windows SDK installed, signtool verify /pa .\DevinSetup-x64-<version>.exe performs the same check. Any other status means the file was altered in transit: discard it and start again from Step 1.
Run DevinSetup-x64-<version>.exe as an administrator. The installer runs elevated and installs Devin - Airgap for all users in C:\Program Files\Devin Airgap\.

The installer does not create or secure the configuration folder; do that in Step 4. The Windows uninstall entry is named Devin Airgap.

Unpack Devin-win32-x64-<version>.zip to a folder of your choice and run Desktop from there; nothing else is installed. Verify the Authenticode signature of the unpacked executables with Get-AuthenticodeSignature, as described for the installer: Status must be Valid and the signer Exafunction, Inc.The folder lockdown in Step 4 applies to a zip install as well.

On Linux, the SHA-256 comparison in Step 2 is the verification step; the packages are not accompanied by a separate signature file.

Step 4: Place the license and models file

Both the standalone CLI and the agent bundled in Desktop read the same two files. Put them at the default paths so no environment variables are needed:

File	Default path	Override
License	`/etc/devin/license.devin-onprem-license`	`DEVIN_LICENSE_FILE`
Models file	`/etc/devin/models.json`	`DEVIN_MODELS_FILE`

On Windows the default directory is C:\ProgramData\Devin\; the overrides are the same:

File	Default path (Windows)	Override
License	`C:\ProgramData\Devin\license.devin-onprem-license`	`DEVIN_LICENSE_FILE`
Models file	`C:\ProgramData\Devin\models.json`	`DEVIN_MODELS_FILE`

Windows: lock down the configuration folder

This step is required on Windows for both the installer and the zip, and the installer does not do it for you. By default, standard users can create files in a new folder under C:\ProgramData, so without the lockdown a user could create models.json (or the license or auth file) before you do and keep control of it. Before placing any file, from an elevated PowerShell session, create the folder and restrict it so that SYSTEM and Administrators have full control and standard users can only read:

New-Item -ItemType Directory -Force C:\ProgramData\Devin
icacls C:\ProgramData\Devin /inheritance:r /grant:r "*S-1-5-18:(OI)(CI)(F)" "*S-1-5-32-544:(OI)(CI)(F)" "*S-1-5-32-545:(OI)(CI)(RX)"

If C:\ProgramData\Devin\ already existed, the commands above are not enough: anything a standard user created in it earlier stays owned by that user, and a permission that was granted on the folder explicitly to another user or group stays in place. After the commands above, also run the following, in this order. They give ownership of the folder and its contents to Administrators, remove every explicit permission from the folder, apply the lockdown again, and reset the permissions on the contents so they inherit the folder’s:

icacls C:\ProgramData\Devin /setowner "*S-1-5-32-544" /T /C
icacls C:\ProgramData\Devin /reset
icacls C:\ProgramData\Devin /inheritance:r /grant:r "*S-1-5-18:(OI)(CI)(F)" "*S-1-5-32-544:(OI)(CI)(F)" "*S-1-5-32-545:(OI)(CI)(RX)"
icacls C:\ProgramData\Devin\* /reset /T /C

Confirm the result. None of the commands above may have shown an error message for any file or folder: /C makes icacls continue past an item it could not change, so an error means that item kept its old owner or permissions. Then list the permissions on the folder and everything in it:

icacls C:\ProgramData\Devin /T

The folder itself, C:\ProgramData\Devin, must list exactly three entries: NT AUTHORITY\SYSTEM:(OI)(CI)(F), BUILTIN\Administrators:(OI)(CI)(F), and BUILTIN\Users:(OI)(CI)(RX), none of them marked (I). Every file and subfolder in it must list the same three users and groups and no others, each marked (I) because it is inherited from the folder; for a file that is NT AUTHORITY\SYSTEM:(I)(F), BUILTIN\Administrators:(I)(F), and BUILTIN\Users:(I)(RX). If any other user or group is listed anywhere, if an entry on the folder is marked (I), or if an entry on a file or subfolder is not marked (I), the lockdown is not in effect; run the commands for an existing folder again. Then copy the license and models file into the folder from the same elevated session. Every model entry names an environment variable that holds its API key (api_key.env); that variable must be set in the environment of the process that runs the agent. See Models file → API key environment variables for how to provide it to Desktop, whose bundled agent inherits the Desktop app’s environment rather than your shell’s.

Step 5: Locate the bundled CLI

The Devin agent CLI is embedded in every Desktop package and is built from the same release commit as Desktop, so the two versions cannot drift apart.

Platform	Path inside the package
macOS	`/Applications/Devin - Airgap.app/Contents/Resources/app/extensions/windsurf/devin/bin/devin`
Linux	`<install root>/resources/app/extensions/windsurf/devin/bin/devin`
Windows	`<install root>\resources\app\extensions\windsurf\devin\bin\devin.exe`, where `<install root>` is `C:\Program Files\Devin Airgap` for the installer or the folder you unpacked the zip to

Use this binary for the devin … commands in this guide, or put it on PATH. Confirm the version:

"/Applications/Devin - Airgap.app/Contents/Resources/app/extensions/windsurf/devin/bin/devin" --version

devin-federal <version>+airgap.<sha>

Step 6: Run the health check

From a shell that has the same environment the agent will run with (in particular the API-key variables named in your models file), run:

devin airgap doctor

pass  license                                seat alice@example.gov (account acme), expires 2027-03-01
pass  models file path                       /etc/devin/models.json
pass  config dir writable                    /home/alice/.config/devin/cli-federal
pass  data dir writable                      /home/alice/.local/share/devin/cli-federal
pass  CA bundle                              not configured (OS trust store only; set DEVIN_CA_BUNDLE to add a private CA)
pass  models file parse                      1 model(s) configured
pass  model 'llama-3.3-70b': API key env var  LOCAL_LLAMA_API_KEY is set
pass  custom subagent profiles               none configured
pass  model 'llama-3.3-70b': endpoint reachability  GET https://models.internal:8000/v1/models -> 200 OK
pass  model 'llama-3.3-70b': inference conformance  POST https://models.internal:8000/v1/chat/completions -> 200 OK (412 ms)

10 check(s): 10 passed, 0 warning(s), 0 failure(s)

The command exits 0 only when no check fails. Any FAIL line carries an error code such as CFG002 or NET003; look it up in Error codes and follow the Troubleshooting runbook.

Step 7: First launch

macOS
Linux
Windows

Launch the installed app by its explicit path:

open "/Applications/Devin - Airgap.app"

Avoid open -a "Devin - Airgap": it resolves the name through LaunchServices and may pick a different copy (a mounted .dmg or an older install) than the one you verified.

Start the launcher installed by the package, or run /opt/Devin-linux-x64/bin/devin-airgap for a tarball install.

If the license is missing or invalid, Desktop still opens but the bundled agent fails: the chat panel shows ACP error -32019 license_invalid. Open View → Output → Devin ACP and look for the LIC00X line, then see License.

Next steps

Configure SSO if your deployment requires user login: SSO.
Add a private CA if your endpoints use internal certificates: Network and certificates.
Learn where the product writes its state and how to ingest the audit log: On-disk formats.

​Before you begin

​Step 1: Download the bundle from the portal

​Step 2: Verify the checksum

​Step 3: Install

​Step 4: Place the license and models file

​Windows: lock down the configuration folder

​Step 5: Locate the bundled CLI

​Step 6: Run the health check

​Step 7: First launch

​Next steps

Before you begin

Step 1: Download the bundle from the portal

Step 2: Verify the checksum

Step 3: Install

Step 4: Place the license and models file

Windows: lock down the configuration folder

Step 5: Locate the bundled CLI

Step 6: Run the health check

Step 7: First launch

Next steps