Devin via Claude Code returns 403 permission_denied: unlisted Cognition blocklist phrases in Claude Code system prompt #8558

Client or integration

Claude Code 2.1.322, both in the terminal and via CloudCLI (a remote manager that spawns the same CLI). Also reproduced with minimal direct HTTP requests against the proxy. Codex is NOT affected — Devin works fine in Codex all day on the same account (see below).

Provider or upstream service

Devin (Cognition), https://server.codeium.com — the devin adapter (src/adapters/devin/cloud-direct/chat.ts). Affects devin/swe-2-flash and devin/swe-2 (both tested; swe-2 currently returns 502 overloaded on the backend, but the blocklist applies regardless of model or account tier per the adapter's own comment).

OpenCodex version

2.100.0 (installed CLI). macOS, Apple Silicon. Observed 2026-11-11.

Endpoint or capability

Inbound POST /v1/messages on the proxy → Devin adapter (adapter: devin). System prompt / instruction-surface sanitization (COGNITION_BLOCKLIST_REWRITES).

Current behaviour

Every Claude Code turn with any Devin model fails with HTTP 403:

{"type":"error","error":{"type":"permission_error","message":"The provider denied access to this request."}}

Root cause: Cognition enforces an exact-phrase blocklist on instruction surfaces (tool descriptions and the system prompt). The proxy's COGNITION_BLOCKLIST_REWRITES table (chat.ts:645) rewrites only 4 known phrases. Claude Code's system prompt contains 3 further blocklisted sentences that are not in the table. Bisecting the live request isolated all three; each one alone triggers the 403, and sub-phrases alone do not (the whole sentence is required, like the Codex permissions entry):

1. You are a Claude agent, built on Anthropic's Claude Agent SDK.
2. Dual-use security tools (C2 frameworks, credential testing, exploit development) require clear authorization context: pentesting engagements, CTF competitions, security research, or defensive use cases.
3. Claude Code is available as a CLI in the terminal, desktop app (Mac/Windows), web app (claude.ai/code), and IDE extensions (VS Code, JetBrains).

Matching behaviour (verified live for #1; #2 and #3 behave the same as whole sentences): the match is case-insensitive with flexible whitespace and optional comma/period — lowercasing the whole sentence, dropping the comma after "agent", or doubling a space still 403s. This is unlike the TaskOutput entry, which the adapter comment notes is case-sensitive and whitespace-exact; these three match like the Codex entries.

Crucially, Codex is unaffected: Devin via Codex (POST /v1/responses) works fine all day on the same account, same proxy, same models. The problem is specific to Claude Code's system prompt. A hand-built minimal request (no system prompt, or a reworded one) returns 200.

Expected behaviour

The proxy should rewrite these three sentences (meaning-preserving, like the existing four entries) so Claude Code + Devin works. The sanitizer already covers the system prompt surface; it just needs the three new entries.

Minimal redacted request or reproduction

# Fails: 403 permission_denied (system = sentence 1 alone)
curl -sS http://127.0.0.1:10100/v1/messages \
  -H 'Content-Type: application/json' \
  -H 'x-api-key: <ocx-token>' -H 'anthropic-version: 2023-06-01' \
  -d '{"model":"devin/swe-2-flash","max_tokens":256,"system":"You are a Claude agent, built on Anthropic'"'"'s Claude Agent SDK.","messages":[{"role":"user","content":"hi"}]}'

# Succeeds: 200 (same sentence, one word reworded)
curl -sS http://127.0.0.1:10100/v1/messages \
  -H 'Content-Type: application/json' \
  -H 'x-api-key: <ocx-token>' -H 'anthropic-version: 2023-06-01' \
  -d '{"model":"devin/swe-2-flash","max_tokens":256,"system":"You are a Claude agent, built on Anthropic'"'"'s Claude Agent Toolkit.","messages":[{"role":"user","content":"hi"}]}'

Probe results (each as the whole system, model devin/swe-2-flash):

Actual response or error

{"type":"error","error":{"type":"permission_error","message":"The provider denied access to this request."}}

Note: the proxy logs no upstream failure line for these 403s (unlike the earlier image 403 and 502s, which are logged), so the failure is silent in service.log.

Suggested mapping or implementation notes

Add three entries to COGNITION_BLOCKLIST_REWRITES in src/adapters/devin/cloud-direct/chat.ts, following the Codex entries' flexible matching (case-insensitive, \s+, optional comma/period), with meaning-preserving rewrites verified live to clear the filter:

1. /\bYou\s+are\s+a\s+Claude\s+agent,?\s+built\s+on\s+Anthropic'?s\s+Claude\s+Agent\s+SDK\b/gi → You are a Claude agent, built on Anthropic's Claude Agent Toolkit.
2. /\bDual-use\s+security\s+tools\s+\(C2\s+frameworks,\s+credential\s+testing,\s+exploit\s+development\)\s+require\s+clear\s+authorization\s+context:\s+pentesting\s+engagements,\s+CTF\s+competitions,\s+security\s+research,\s+or\s+defensive\s+use\s+cases\.?/gi → Dual-purpose security tools (C2 frameworks, credential testing, exploit development) need clear authorization context: pentesting engagements, CTF competitions, security research, or defensive use cases.
3. /\bClaude\s+Code\s+is\s+available\s+as\s+a\s+CLI\s+in\s+the\s+terminal,\s+desktop\s+app\s+\(Mac\/Windows\),\s+web\s+app\s+\(claude\.ai\/code\),\s+and\s+IDE\s+extensions\s+\(VS\s+Code,\s+JetBrains\)\.?/gi → Claude Code ships as a CLI in the terminal, desktop app (Mac/Windows), web app (claude.ai/code), and IDE extensions (VS Code, JetBrains).

Verification after patching: a Claude Code turn with Devin returns 200 with the original system prompt; the three rewordings above are the smallest edits measured to clear the filter. Add regression tests in tests/devin-adapter.test.ts (the table's own comment asks for this when extending it). Note the adapter comment says the blocklist is "case-sensitive, whitespace-exact" for the TaskOutput phrase — these three new entries do NOT behave that way (lowercase / extra whitespace still 403), so use the flexible form.

Additional context and attachments

• Checked for duplicates: no existing issue or PR mentions these three sentences or a Claude Code system-prompt blocklist entry. (Related: [Provider compatibility] Codex 0.155 access_programs is forwarded to strict third-party Responses upstreams and 400s every OpenCode Go muse-spark turn #4853, same author, same pattern — a client-sent field the upstream rejects; fixed the same way.)
• Codex is unaffected and is the current workaround (Devin via Codex works); Claude Code users must use Kiro Opus or WorkBuddy DeepSeek in the meantime.
• This affects all Devin models and account tiers (the adapter comment: the blocklist trigger causes permission_denied "regardless of model or account tier"), so buying a Devin subscription does not help.
• Requests above are redacted: no credentials, tokens, account labels, or conversation content are included.
• The trigger is in the system prompt, not a tool description — so the existing "only blame the blocklist when tools were actually sent" guard (chat.ts ~1642) can mislead here; the blocklist also covers the [codex] Add Neuralwatt effort routing #2 system prompt surface.

Upstream documentation

No public specification exists. Cognition's blocklist is undocumented server-side behavior — there is no published document describing which phrases are blocked. The three trigger phrases in this issue were identified by live bisection probing against the Devin API (see the probe table above), not from any public specification.