feat(devin): add ZERO-294 Devin Desktop adapter

[spencercharest]

Summary

• Adds zero-devin, a Devin Desktop / Windsurf project-template adapter for ZERO-307 under ZERO-294.
• Ships Devin Local / CLI config, skill, hooks, and rule surfaces via .devin/ plus cross-agent .agents/skills/zero.
• Ships Cascade-oriented .windsurf/workflows/zero.md and an MCP config fragment for the user-level Cascade MCP config.
• Adds guides/devin-desktop.md, README install link, scripts/build-devin.sh, and a 1.4.0 version bump through make minor.

guides/agent-install.md is intentionally not modified in this PR.

Official Sources Used

• Devin Desktop / Cascade skills: https://docs.devin.ai/desktop/cascade/skills
• Devin Desktop / Cascade rules: https://docs.devin.ai/desktop/cascade/memories
• Devin Desktop / Cascade workflows: https://docs.devin.ai/desktop/cascade/workflows
• Devin Desktop / Cascade MCP: https://docs.devin.ai/desktop/cascade/mcp
• Devin Local agent: https://docs.devin.ai/desktop/devin-local
• Devin CLI config: https://docs.devin.ai/cli/reference/configuration/config-file
• Devin CLI skills: https://docs.devin.ai/cli/extensibility/skills/creating-skills
• Devin CLI hooks: https://docs.devin.ai/cli/extensibility/hooks/overview
• Devin CLI hook lifecycle: https://docs.devin.ai/cli/extensibility/hooks/lifecycle-hooks
• Devin CLI MCP config: https://docs.devin.ai/cli/extensibility/mcp/configuration
• Devin CLI quickstart / install: https://docs.devin.ai/cli
• Devin CLI commands: https://docs.devin.ai/cli/reference/commands

Install / Update Surfaces

Human in-harness flow:

• Devin Desktop / Cascade does not expose a one-artifact Zero plugin installer for local skills, rules, hooks, and workflows.
• For Cascade MCP only, add Zero through the MCP UI or merge this fragment into ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "zero": {
      "serverUrl": "https://mcp.zero.xyz"
    }
  }
}

Terminal/project-template flow:

curl -fsSL https://zero.xyz/install.sh | bash
rm -rf /tmp/zero-plugins
git clone --depth 1 https://github.com/officialzeroxyz/zero-plugins /tmp/zero-plugins
/tmp/zero-plugins/scripts/build-devin.sh
cp -R /tmp/zero-plugins/dist/zero-devin/. .

Update flow:

curl -fsSL https://zero.xyz/install.sh | bash
rm -rf /tmp/zero-plugins
git clone --depth 1 https://github.com/officialzeroxyz/zero-plugins /tmp/zero-plugins
/tmp/zero-plugins/scripts/build-devin.sh
cp -R /tmp/zero-plugins/dist/zero-devin/. .

Proposed guides/agent-install.md Notes

Do not apply these in this PR; collect them when the runbook is reworked.

• Add a Devin Desktop / Windsurf section covering two surfaces:
  • Cascade: .agents/skills/zero, .devin/rules/zero.md, .windsurf/workflows/zero.md, and a user-level ~/.codeium/windsurf/mcp_config.json MCP merge/paste step.
  • Devin Local / CLI: .devin/config.json, .devin/skills/zero/SKILL.md, and .devin/hooks.v1.json.
• Note that Cascade workflows remain .windsurf/workflows/*.md, while rules have moved to preferred .devin/rules/*.md with .windsurf/rules/*.md as a legacy fallback.
• Note that Cascade MCP config is user-level (~/.codeium/windsurf/mcp_config.json); this PR’s .windsurf/mcp_config.json is a copyable config fragment, not a guaranteed workspace-discovered MCP file.
• Note that Devin Local / CLI hooks use .devin/hooks.v1.json, with SessionStart, UserPromptSubmit, and PermissionRequest events. The PermissionRequest hook only approves read-only Zero commands (search, get, review, runs, read-only config, init) and leaves fetch, wallet, and unknown commands to normal approval.
• Keep standalone runner install/update as curl -fsSL https://zero.xyz/install.sh | bash; rerun the template build/copy commands for project-file updates.

Verification

Local checks:

• make minor -> bumped all manifests to 1.4.0.
• scripts/build-devin.sh --tar dist/zero-devin.tgz
• jq -e . plugins/zero-devin/manifest.json plugins/zero-devin/devin/config.json plugins/zero-devin/devin/hooks.v1.json plugins/zero-devin/windsurf/mcp_config.json
• make version -> 1.4.0
• git diff -- guides/agent-install.md -> no diff
• Devin permission hook smoke:
  • zero search weather emits {"decision":"approve","reason":"Zero read-only operation approved"}
  • zero fetch ... emits no approval output

Docker template + copied-auth Zero loop:

• Image: node:24-bookworm
• Copied host ~/.zero into the container as $HOME/.zero.
• Installed container-local @zeroxyz/cli@latest to avoid host runtime shim path issues.
• Applied dist/zero-devin/ into a clean /work/project.
• Ran Devin hook provisioning with DEVIN_PROJECT_DIR=/work/project bash .devin/zero/hooks/ensure-runner.sh.
• Verified Zero auth in Docker as spencer@pie.org.
• Ran the required CDN capability flow without zero review:
  • search: zero search "cdn.withzero.xyz upload txt file" --json
  • get: zero get cdn-withzero-xyz-static-site-file-cdn-upload-a0d9f22f
  • fetch: zero fetch --json --capability cdn-withzero-xyz-static-site-file-cdn-upload-a0d9f22f https://cdn.withzero.xyz/api/v1/uploads -d @/tmp/zero-cdn-body.json --max-pay 0.001
  • run ID: run_H0is7Ay139ihchVe3JQc1
  • returned URL: https://cdn.withzero.xyz/LolkTqxW/agent-harness-e2e-devin-docker-20260615T001451Z.txt
  • payment: 0 USDC via mpp on tempo
  • returned body verified with curl + cmp: ZERO-307 Devin Docker copied-auth CDN upload check 20260615T001451Z

Docker Devin CLI discovery:

• Installed official Devin CLI via curl -fsSL https://cli.devin.ai/install.sh | bash.
• Installer installed devin 2026.5.26-8 (1a388fa9) but exited 1 after non-interactive login was canceled.
• devin skills list in the templated project discovered:
  • /zero [user,model] (./.devin/skills/zero)
  • /zero [user] (./.windsurf/workflows)
• devin mcp list discovered configured zero MCP server at https://mcp.zero.xyz.
• devin auth status reported Not logged in; devin -p ... exits with Error: Login canceled in Docker.

Claude-style plugin compatibility and simpler install option

Full Claude Code plugin package support: No for Devin Desktop/Windsurf native surfaces. Some Devin/Windsurf surfaces can read Claude-compatible skill directories, but there is no documented native install of Claude Code .claude-plugin packages.

What this means for users:

• If a user is running Claude Code through an ACP/external-agent path, the best install is the existing Zero Claude Code plugin, not this adapter.

• For native Devin Desktop/Windsurf, the simplest consumer path should be a prebuilt template artifact with skill + remote MCP + workflow/rules files:

  curl -fsSL https://zero.xyz/install.sh | bash
  # download/extract the prebuilt zero-devin artifact into the project
  # open Devin Desktop/Windsurf and let it pick up the skill/MCP/workflow files

• Keep scripts/build-devin.sh as maintainer packaging only. If the native adapter does not add enough over skill + MCP, the lower-maintenance choice is to document that reduced path and avoid deeper custom hook claims.

GitHub Releases / no-build install check

Result: No confirmed Gemini-style GitHub Release install path for native Devin Desktop/Windsurf. Current docs surfaced MCP and skill/workflow-style configuration, but not a release-asset plugin installer equivalent to Gemini CLI.

Best no-build consumer path:

curl -fsSL https://zero.xyz/install.sh | bash
curl -L https://github.com/officialzeroxyz/zero-plugins/releases/latest/download/zero-devin.tar.gz | tar -xz -C .

That avoids local builds, but it is still manual extract packaging. If the user runs Claude Code through an ACP/external-agent path, use the existing Zero Claude Code plugin instead; that is simpler and more capable than maintaining native Devin/Windsurf release archives.

Status

Draft because the full Devin agent turn cannot be completed in Docker without Devin CLI/Desktop login. The adapter files, Devin CLI discovery, MCP config discovery, hook smoke, copied-auth Zero runner provisioning, and direct Zero CDN fetch loop all passed.

[spencercharest]

Folded into #63 as a matrix entry (devin in plugins/zero/agents.json) — targeting the Devin CLI's user-level surface that landed since this PR: ~/.config/devin/config.json with Claude-shaped hooks that natively accept hookSpecificOutput (SessionStart + UserPromptSubmit mapped; auto-approve omitted — Devin tool names aren't Bash and approvals ride PermissionRequest). The Windsurf/Cascade ~/.codeium surfaces from this branch stay out of matrix scope. The adapter-template work here stays available on this branch if we later ship per-host templates.