> ## Documentation Index > Fetch the complete documentation index at: https://docs.devin.ai/llms.txt > Use this file to discover all available pages before exploring further. # Install Air-Gapped Devin Desktop > Download the air-gapped Devin Desktop bundle from the portal, verify its SHA-256 checksum, install it on macOS, Linux, or Windows, and run a health check. > [!NOTE] > > This documentation is for the federal deployments of Devin. [Back to Devin Docs](/get-started/devin-intro) This page walks you through a first install of the air-gapped Devin Desktop bundle, which includes the air-gapped Devin CLI. Complete it on one workstation first, then repeat for your fleet using your approved media process. ## Before you begin * You are signed in to the portal as an **approved member of a team with an active on-prem entitlement**. Without the entitlement the air-gapped downloads page reports that you are not eligible; contact your account team. * You have prepared, or are ready to prepare, the two files every host needs before first launch: * a **license file**, issued from the portal (see [License](/federal/air-gapped/license)); * a **models file** describing your model endpoints (see [Models file](/federal/air-gapped/models-file)). * The target host runs a supported platform: macOS (Apple silicon or Intel), Linux (x86\_64 or aarch64), or Windows (x64 or arm64). ## Step 1: Download the bundle from the portal 1. In the portal, open **Install → Air-gapped downloads** ([`windsurf.fedstart.com/install/airgap`](https://windsurf.fedstart.com/install/airgap)). 2. Choose the **Devin Desktop** installer for the target platform. The page lists one package per platform and format: | Platform | Formats | | - | - | | macOS, Apple silicon | `.dmg` | | macOS, Intel | `.dmg` | | Linux x64 | `.deb`, `.rpm`, `.tar.gz` | | Linux arm64 | `.deb`, `.rpm`, `.tar.gz` | | Windows x64 | `.exe` (system installer), `.zip` | | Windows arm64 | `.exe` (system installer), `.zip` | The Windows files are named `DevinSetup--.exe` and `Devin-win32--.zip`, where `` is `x64` or `arm64`. The installer installs for all users; there is no per-user installer. 3. Note the **SHA-256** checksum the page shows next to the file (use **Show checksum**). You will compare against it after transfer. 4. Transfer the file into the air-gapped environment by your approved media process. The same page offers two further downloads, each with its own SHA-256 checksum: | Download | File | Purpose | | - | - | - | | **Desktop tunnel CLI** | `Devin-cli-linux-x64-.tar.gz`, `Devin-cli-linux-arm64-.tar.gz` | The standalone `devin-desktop-airgap` command-line tunnel for connecting Desktop to a remote host over SSH. Install it on the remote machine, not the workstation. | | **Remote extension host** | `devin-reh-linux--.tar.gz`, `devin-reh-darwin--.tar.gz` | The server component Desktop installs on SSH targets. Stage it for hosts that cannot fetch it themselves. | The Devin *agent* CLI (`devin`) is not one of these downloads: it ships inside every Desktop package (see [Step 5](#step-5-locate-the-bundled-cli)). ## Step 2: Verify the checksum On the target host (or before crossing the air gap), compute the SHA-256 of the downloaded file and compare it with the value shown in the portal. **macOS** ```sh theme={null} shasum -a 256 Devin-darwin-arm64-.dmg ``` ```text theme={null} 3f6c…e21a Devin-darwin-arm64-.dmg ``` **Linux** ```sh theme={null} sha256sum Devin-linux-x64-.deb ``` ```text theme={null} 3f6c…e21a Devin-linux-x64-.deb ``` **Windows** ```powershell theme={null} Get-FileHash -Algorithm SHA256 .\DevinSetup-x64-.exe ``` The `Hash` value must match the checksum on the portal page; `Get-FileHash` prints it in upper case, so compare without regard to case. The first column must match the checksum on the portal page exactly. If it does not, discard the file and download it again. ## Step 3: Install **macOS** 1. Open the `.dmg` and drag **Devin - Airgap** into `/Applications`. 2. Verify the code signature and notarization before first launch: ```sh theme={null} spctl --assess --type execute --verbose "/Applications/Devin - Airgap.app" codesign --verify --deep --strict "/Applications/Devin - Airgap.app" ``` ```text theme={null} /Applications/Devin - Airgap.app: accepted source=Notarized Developer ID ``` `spctl` prints `accepted`; `codesign --verify` prints nothing and exits `0` when the signature is intact. Any `rejected` or `code object is not signed at all` output means the bundle was altered in transit: discard it and start again from Step 1. **Linux (.deb / .rpm)** ```sh theme={null} sudo dpkg -i Devin-linux-x64-.deb # Debian/Ubuntu sudo rpm -i Devin-linux-x64-.rpm # RHEL/Fedora ``` There is no apt or yum repository for air-gapped builds; install and upgrade from the package files directly. **Linux (.tar.gz)** ```sh theme={null} sudo tar -xzf Devin-linux-x64-.tar.gz -C /opt ``` The launcher is `/opt/Devin-linux-x64/bin/devin-airgap`. **Windows (installer)** 1. Verify the Authenticode signature of the installer before running it: ```powershell theme={null} Get-AuthenticodeSignature .\DevinSetup-x64-.exe | Format-List Status, SignerCertificate ``` `Status` must be `Valid` and the signer certificate must be issued to `Exafunction, Inc.` With the Windows SDK installed, `signtool verify /pa .\DevinSetup-x64-.exe` performs the same check. Any other status means the file was altered in transit: discard it and start again from Step 1. 2. Run `DevinSetup-x64-.exe` as an administrator. The installer runs elevated and installs **Devin - Airgap** for all users in `C:\Program Files\Devin Airgap\`. The installer does not create or secure the configuration folder; do that in [Step 4](#windows-lock-down-the-configuration-folder). The Windows uninstall entry is named **Devin Airgap**. **Windows (.zip)** Unpack `Devin-win32-x64-.zip` to a folder of your choice and run Desktop from there; nothing else is installed. Verify the Authenticode signature of the unpacked executables with `Get-AuthenticodeSignature`, as described for the installer: `Status` must be `Valid` and the signer `Exafunction, Inc.` The folder lockdown in [Step 4](#windows-lock-down-the-configuration-folder) applies to a zip install as well. On Linux, the SHA-256 comparison in Step 2 is the verification step; the packages are not accompanied by a separate signature file. ## Step 4: Place the license and models file Both the standalone CLI and the agent bundled in Desktop read the same two files. Put them at the default paths so no environment variables are needed: | File | Default path | Override | | - | - | - | | License | `/etc/devin/license.devin-onprem-license` | `DEVIN_LICENSE_FILE` | | Models file | `/etc/devin/models.json` | `DEVIN_MODELS_FILE` | On Windows the default directory is `C:\ProgramData\Devin\`; the overrides are the same: | File | Default path (Windows) | Override | | - | - | - | | License | `C:\ProgramData\Devin\license.devin-onprem-license` | `DEVIN_LICENSE_FILE` | | Models file | `C:\ProgramData\Devin\models.json` | `DEVIN_MODELS_FILE` | ### Windows: lock down the configuration folder This step is required on Windows for both the installer and the zip, and the installer does not do it for you. By default, standard users can create files in a new folder under `C:\ProgramData`, so without the lockdown a user could create `models.json` (or the license or auth file) before you do and keep control of it. **Before placing any file**, from an elevated PowerShell session, create the folder and restrict it so that SYSTEM and Administrators have full control and standard users can only read: ```powershell theme={null} New-Item -ItemType Directory -Force C:\ProgramData\Devin icacls C:\ProgramData\Devin /inheritance:r /grant:r "*S-1-5-18:(OI)(CI)(F)" "*S-1-5-32-544:(OI)(CI)(F)" "*S-1-5-32-545:(OI)(CI)(RX)" ``` If `C:\ProgramData\Devin\` already existed, the commands above are not enough: anything a standard user created in it earlier stays owned by that user, and a permission that was granted on the folder explicitly to another user or group stays in place. After the commands above, also run the following, in this order. They give ownership of the folder and its contents to Administrators, remove every explicit permission from the folder, apply the lockdown again, and reset the permissions on the contents so they inherit the folder's: ```powershell theme={null} icacls C:\ProgramData\Devin /setowner "*S-1-5-32-544" /T /C icacls C:\ProgramData\Devin /reset icacls C:\ProgramData\Devin /inheritance:r /grant:r "*S-1-5-18:(OI)(CI)(F)" "*S-1-5-32-544:(OI)(CI)(F)" "*S-1-5-32-545:(OI)(CI)(RX)" icacls C:\ProgramData\Devin\* /reset /T /C ``` Confirm the result. None of the commands above may have shown an error message for any file or folder: `/C` makes `icacls` continue past an item it could not change, so an error means that item kept its old owner or permissions. Then list the permissions on the folder and everything in it: ```powershell theme={null} icacls C:\ProgramData\Devin /T ``` The folder itself, `C:\ProgramData\Devin`, must list exactly three entries: `NT AUTHORITY\SYSTEM:(OI)(CI)(F)`, `BUILTIN\Administrators:(OI)(CI)(F)`, and `BUILTIN\Users:(OI)(CI)(RX)`, none of them marked `(I)`. Every file and subfolder in it must list the same three users and groups and no others, each marked `(I)` because it is inherited from the folder; for a file that is `NT AUTHORITY\SYSTEM:(I)(F)`, `BUILTIN\Administrators:(I)(F)`, and `BUILTIN\Users:(I)(RX)`. If any other user or group is listed anywhere, if an entry on the folder is marked `(I)`, or if an entry on a file or subfolder is not marked `(I)`, the lockdown is not in effect; run the commands for an existing folder again. Then copy the license and models file into the folder from the same elevated session. Every model entry names an environment variable that holds its API key (`api_key.env`); that variable must be set in the environment of the process that runs the agent. See [Models file → API key environment variables](/federal/air-gapped/models-file#api-key-environment-variables) for how to provide it to Desktop, whose bundled agent inherits the **Desktop app's** environment rather than your shell's. ## Step 5: Locate the bundled CLI The Devin agent CLI is embedded in every Desktop package and is built from the same release commit as Desktop, so the two versions cannot drift apart. | Platform | Path inside the package | | - | - | | macOS | `/Applications/Devin - Airgap.app/Contents/Resources/app/extensions/windsurf/devin/bin/devin` | | Linux | `/resources/app/extensions/windsurf/devin/bin/devin` | | Windows | `\resources\app\extensions\windsurf\devin\bin\devin.exe`, where `` is `C:\Program Files\Devin Airgap` for the installer or the folder you unpacked the zip to | Use this binary for the `devin …` commands in this guide, or put it on `PATH`. Confirm the version: ```sh theme={null} "/Applications/Devin - Airgap.app/Contents/Resources/app/extensions/windsurf/devin/bin/devin" --version ``` ```text theme={null} devin-federal +airgap. ``` ## Step 6: Run the health check From a shell that has the same environment the agent will run with (in particular the API-key variables named in your models file), run: ```sh theme={null} devin airgap doctor ``` ```text theme={null} pass license seat alice@example.gov (account acme), expires 2027-03-01 pass models file path /etc/devin/models.json pass config dir writable /home/alice/.config/devin/cli-federal pass data dir writable /home/alice/.local/share/devin/cli-federal pass CA bundle not configured (OS trust store only; set DEVIN_CA_BUNDLE to add a private CA) pass models file parse 1 model(s) configured pass model 'llama-3.3-70b': API key env var LOCAL_LLAMA_API_KEY is set pass custom subagent profiles none configured pass model 'llama-3.3-70b': endpoint reachability GET https://models.internal:8000/v1/models -> 200 OK pass model 'llama-3.3-70b': inference conformance POST https://models.internal:8000/v1/chat/completions -> 200 OK (412 ms) 10 check(s): 10 passed, 0 warning(s), 0 failure(s) ``` The command exits `0` only when no check fails. Any `FAIL` line carries an error code such as `CFG002` or `NET003`; look it up in [Error codes](/federal/air-gapped/error-codes) and follow the [Troubleshooting](/federal/air-gapped/troubleshooting) runbook. ## Step 7: First launch **macOS** Launch the installed app by its explicit path: ```sh theme={null} open "/Applications/Devin - Airgap.app" ``` Avoid `open -a "Devin - Airgap"`: it resolves the name through LaunchServices and may pick a different copy (a mounted `.dmg` or an older install) than the one you verified. **Linux** Start the launcher installed by the package, or run `/opt/Devin-linux-x64/bin/devin-airgap` for a tarball install. **Windows** Start the installed **Devin - Airgap** app, or, for a zip install, run the application from the folder you unpacked. If the license is missing or invalid, Desktop still opens but the bundled agent fails: the chat panel shows ACP error `-32019 license_invalid`. Open **View → Output → Devin ACP** and look for the `LIC00X` line, then see [License](/federal/air-gapped/license#error-codes). ## Next steps * Configure SSO if your deployment requires user login: [SSO](/federal/air-gapped/sso). * Add a private CA if your endpoints use internal certificates: [Network and certificates](/federal/air-gapped/network-and-certificates). * Learn where the product writes its state and how to ingest the audit log: [On-disk formats](/federal/air-gapped/on-disk-formats). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.