Skip to main content

​
Quick start

Paste this into a cloud session and replace ~/code/my-app with your project folder:
When Devin requests access:
  • Devin Desktop: Click Approve in the session.
  • Web app: Run the devin connect command from the access card in a terminal on your computer. Leave it running.
  • Devin CLI: If you started the session with devin --cloud, the CLI connects your computer automatically.
Review local actions as Devin requests them. A local session already runs on your computer and doesn’t need Local Hands.

​
First-time setup

On the computer you want to connect, sign in with the same Devin account that owns the cloud session:
  • Desktop: Install Devin Desktop and choose Cloud when starting a session. For an existing web session, choose Open in > Devin Desktop from the session menu.
  • Web or CLI: Install the Devin CLI and run devin auth login. Open a session at app.devin.ai or start one with devin --cloud.

​
How it works

Devin can also request access on its own when a task needs something on your computer, such as uncommitted changes or a tool behind your VPN. Your computer does not replace the session’s VM. Devin keeps its VM and gets a second set of tools that run on your machine. The two machines have separate files, working directories, and environments; Devin moves data between them only through tool calls that you approve, such as a file copy.
Local Hands is the name of the feature; the access card and the toasts describe it as local machine access. The session header shows a connected machine as Local Hands. Local Hands are not Devin Connect, which gives Devin access to private networks.

​
Requirements

  • A cloud session that you own. Devin issues the pairing code to the session owner’s account, so another person who views the session cannot connect their machine. Sessions with no user to approve access, such as scheduled sessions, automations, and API sessions run by a service user, cannot request a machine.
  • The Devin CLI or Devin Desktop on the machine you connect, signed in with the same Devin account that owns the session.
  • The Local Hands setting on for your organization. See Availability.

​
Access requests

A request is single-use and expires 10 minutes after Devin makes it. A new request replaces an older one, and the older pairing code stops working. If the request expired, click Connect this machine on the card in Devin Desktop, or Request a new code in the browser. In Devin Desktop, the card also has Decline, and Use the terminal instead if you prefer to run devin connect.

​
Session privacy

When you connect a machine to a session you own, Devin makes the session private: only you can send it messages. This stops other people in your organization from steering a session that can run commands on your computer. To leave the session’s privacy unchanged, pass --public:

​
What Devin can do on your machine

Devin can run shell commands, read and search files, create and edit files, and copy files between your machine and the session’s VM. Devin has no screen, keyboard, or mouse control on your machine. Computer use applies to the session’s VM only.

​
Approvals

By default, every local tool call stops and asks you. The session shows the tool and its arguments with three choices:
  • Allow once: run this call.
  • Allow for this session: run this call, and later calls of the same tool, without a prompt until the machine disconnects.
  • Deny: reject this call. Devin sees the denial and can try a different approach.
Your Devin CLI permission rules also apply to local tool calls. An allow rule runs a matching call without a prompt, a deny rule blocks it, and an ask rule makes it prompt each time. This includes rules that your organization sets in Team Settings.

​
Bypass local permissions

To stop the per-call prompts, click Bypass local permissions on the access card or in the Local Hands menu. Local tool calls then run without a prompt until the machine disconnects. Pending requests are approved immediately. To start every connection in bypass, set local_tools_bypass_permissions in your Devin CLI config. When you turn bypass on or off from the session, the CLI updates this setting.
With bypass on, Devin can run commands and change files on your computer without asking. Use it only for sessions and tasks you trust.

​
Calls that always ask

Built-in rules make some calls ask every time, even with bypass on. Allow for this session and your own allow rules do not approve them either. They cover credential files and private keys, privilege escalation, destructive commands, shell interpreters, secret stores, and writes to shell profiles and Git config. The approval card says why a call needs explicit approval. Your ask rules and your organization’s ask rules behave the same way.

​
Disconnect or revoke access

  • Revoke access: click Revoke access on the access card or in the Local Hands menu. Devin loses the local tools immediately.
  • Stop the CLI: press Ctrl+C in the terminal that runs devin connect.
  • Close Devin Desktop: the connection ends when you close the Devin Desktop window that approved the request, or quit Devin Desktop.
  • End the session: the connection closes when the session ends.
devin connect reconnects by itself after a short network loss. When the machine stays offline or you stop the command, the chip shows the machine as disconnected. To connect again, ask Devin to request access again and use the new code.

​
Availability

Local Hands are rolling out gradually. If you don’t see the Local Hands setting, the feature is not yet available to your organization. Organization admins control this feature with the Local Hands toggle in Settings > Devin. The toggle is on by default for organizations that are not part of an enterprise, and off by default for organizations in an enterprise. Local Hands are not available when:
  • The session uses a security profile.
  • Native deployments are off for your organization.
  • The session has no user to approve access (scheduled sessions, automations, and service-user API sessions).

​
Troubleshooting

Devin Cloud in the CLI

Start and steer cloud sessions from your terminal

CLI permissions

Write allow, ask, and deny rules for tool calls

Hand off to cloud Devins

Move a local task to a cloud session

Computer use

How Devin uses the desktop of its own VM