sbx/devin-kit:20260917-ab33ec15bdb679413851874f9206250af3a3f117

schemaVersion: "2"
kind: sandbox
name: devin
version: 1.0.0
displayName: Devin
description: Devin CLI by Cognition, signed in from inside the sandbox and resolved by the sandbox proxy thereafter.
sandbox:
    image: docker.io/sbx/devin-image:latest
    entrypoint:
        - devin
    command:
        default:
            - --permission-mode
            - dangerous
            - --respect-workspace-trust=false
        interactive:
            - --permission-mode
            - dangerous
            - --respect-workspace-trust=false
agentInstructions:
    filename: AGENTS.md
permissions:
    network:
        allow:
            - '*.devin.ai'
            - windsurf.com
            - server.codeium.com
            - unleash.codeium.com
            - archive.ubuntu.com
            - security.ubuntu.com
            - ports.ubuntu.com
            - download.docker.com
credentials:
    - service: devin
      description: Devin account credential captured during in-sandbox login
      apiKey:
        name: ""
        inject:
            - domain: server.codeium.com
              header: Authorization
              format: Bearer %s
            - domain: api.devin.ai
              header: Authorization
              format: Bearer %s
      oauth:
        tokenEndpoint:
            host: api.devin.ai
            path: /auth/cli/token
        resourceHosts:
            - server.codeium.com
            - api.devin.ai
        sentinels:
            accessToken: ""
            refreshToken: ""
        credentialFile:
            path: ~/.local/share/devin/credentials.toml
            template: |
                api_server_url = "https://server.codeium.com"
                devin_webapp_host = "app.devin.ai"
                devin_api_url = "https://api.devin.ai"
                windsurf_api_key = "{{.PrimaryApiKey}}"
        responseFields:
            accessToken: token
            refreshToken: token
        passthrough: true
setup:
    startup:
        - command:
            - sh
            - -c
            - '{ command -v apt-get && apt-get update -qq -y || true; } >/dev/null 2>&1 </dev/null &'
          user: root
          description: Update apt package cache in background
        - command:
            - sh
            - -c
            - |
              set -e
              [ -n "$MCP_GATEWAY_URL" ] || exit 0
              mkdir -p "$HOME/.config/devin"
              cat > "$HOME/.config/devin/mcp_config.json" <<EOF
              {
                "mcpServers": {
                  "mcp-gateway": {
                    "url": "$MCP_GATEWAY_URL",
                    "transport": "http",
                    "headers": {
                      "Authorization": "Bearer $MCP_SENTINEL_TOKEN_NAME"
                    }
                  }
                }
              }
              EOF
          user: agent
          description: Register the sandbox MCP gateway
    files:
        - path: /home/agent/.config/devin/config.json
          content: '{"auto_update": false}'
          onlyIfMissing: true
          description: Disable Devin background updates