Auto-review

Auto-review sits between a bot and effectful plugin actions or shell commands on its Runner. It decides, one action at a time, whether to run it or to ask you.

Permission cards

When an action needs your say, the bot posts a card in the chat:

Chef wants to use GitHub · create_issue · repo: acme/api

or:

Chef wants to run a command on Workbench

$ cargo publish

with the reason it paused. Click a command to see all of it. Under the answers, a shell command's card names the rule Auto-review proposes for commands like it:

Always allow adds the rule “publish the crates in ~/dev/lorca to crates.io”.

The three answers:

• Allow once runs this action.
• Always allow runs it and adds a rule, so actions like it run on their own from then on. For a shell command that is the rule on the card, in plain language; change its words in Settings like any rule you wrote. For a plugin action the rule covers that exact tool. A shell card without a proposed rule, such as when Auto-review is off, offers Allow once and Deny.
• Deny refuses it. The bot is told not to retry.

You can answer from any device. The bot waits up to ten minutes.

How it decides

With Auto-review on, each action is judged against your rules, your latest message, and built-in checks:

• Asks first: deleting or overwriting, posting where other people see it, anything involving money or access, bulk or irreversible changes.
• Runs: contained, reversible work you asked for.

With Auto-review off, every shell command and every effectful plugin action asks.

Read-only plugin actions never ask, and neither do read-only shell commands: Lorca parses every stage of a command, and one that only reads, such as git status, ls, or rg TODO src | wc -l, runs at once. A command that writes, deletes, installs, runs code, or reads keys and tokens goes to a small, fast model on the bot's provider, such as GPT-6 Luna on ChatGPT or Claude Haiku 4.5 on Anthropic, which applies the built-in checks, your rules, and your latest request. Lorca's own folders, ~/.lorca and ~/.lorca-dev, belong to the bots: a command that stays inside them runs without a review, whatever it does there. Temporary folders such as /tmp count as scratch space, so cleaning up there doesn't ask.

Shell access

An allowed shell command runs as your user with your normal filesystem, process, credentials, and network access. Its working directory is context, not a security boundary. This full-computer access is what lets a skill drive installed CLIs, applications, builds, services, and files outside its workspace.

Auto-review and the permission card are the boundary. Lorca reviews the complete command before starting it; denying a held action means none of its stages run.

Rules

Open Settings › Auto-review to turn it on or off and to write rules in plain language:

When a bot wants to: comment on a pull request → Ask first

When a bot wants to: label issues in my own repos → Allow automatically

Always allow adds its rules here too. When two rules disagree, Ask first wins. Rules sync to all your devices and apply to every bot.

Routines

A routine runs with nobody watching, so an action that would ask is refused instead. Actions that Auto-review allows, including those your rules cover, still run.