Devin

Install methods

• Plugin: chock install --client devin (ask the user before running it)
• Repo hooks: chock sync --repo . --agents devin writes .devin/hooks.v1.json (ask the user before running it)

Install steps

Devin (devin)

Tested

The command (ask the user before running it: it builds a plugin of hooks that change how their agent behaves):

chock install --selection <code> --client devin --apply

With --apply, chock runs these steps for Devin:

On Windows, devin plugins install --local creates a symbolic link, so it needs Developer Mode (Settings > System > For developers) or an elevated shell; otherwise it fails with "os error 1314: A required privilege is not held by the client".

1. devin plugins install --local ~/.chock/marketplace/devin/chock-guardrails

The plugin is linked in place: a rebuild applies from the next Devin session.

What it can enforce

Tier

block+rewrite

Grade before a tool runs

best-effort

Fail mode before a tool runs

open

Basis

vendor-docs

Recorded

2026-08-26

Events

Ask support

Answers an ask with: block. Honours ask: no. Evidence: tested (tests/test_guard_fail_to_ask.py::test_a_crashed_guard_asks_rather_than_allowing).

Hook timeout

Default 600 seconds, set by the timeout field in s.

Vendor source

Test status

• Plugin (devin): tested.
• Repo hooks: untested. A test of the plugin says nothing about repo hooks.
• Through the plugin install, at hook point plugin-hook: Devin CLI 3000.11.3 (local session), Windows, 2026-10-08. live probe of a chock plugin installed with devin plugins install --local. block-no-verify and chock-guardrails-protect refused a shell command before it ran. pin-github-actions did not refuse the write itself. It refused only at turn end (stop). Chock's protection of its own files held (org-plan witness/results/witness-devin-2026-10-08.md, 0f06113)

Known limits

Speaks Claude Code's hook format almost exactly, and reads .claude/settings.json for hooks by default -- so a repo with Claude Code hooks is already running them under Devin. A block is top-level {"decision": "block"}, not permissionDecision. There is no ask in the vocabulary. Non-zero exit codes other than 2 are logged without blocking, so this fails OPEN. A SessionStart payload is indistinguishable from Claude Code's, and detect() refuses to guess between them.