Auto-review

Auto-review sits between a bot and effectful plugin actions or shell commands on its Runner, including the commands of a coding agent the bot runs. It decides, one action at a time, whether to run it or to ask you.

It comes after the bot's Access: an action Access doesn't allow never reaches Auto-review, and no rule or answer here widens Access. In a chat, emails and Slack messages skip it and wait as drafts that you send yourself.

Permission cards

When an action needs your say, the bot posts a card in the chat:

Chef wants to use GitHub · create_issue · repo: acme/api

or:

Chef wants to run a command on Workbench

$ cargo publish

with the reason it paused. Click a command to see all of it. Under the answers, a shell command's card names the rule Auto-review proposes for commands like it:

Always allow adds the rule “publish the crates in ~/dev/lorca to crates.io”.

The three answers:

• Allow once runs this action.
• Always allow runs it and adds a rule, so actions like it run on their own from then on. For a shell command that is the rule on the card, in plain language; change its words in Settings like any rule you wrote. For a plugin action the rule covers that exact tool. A shell card without a proposed rule, such as when Auto-review is off or a decision model reviewed, offers Allow once and Deny.
• Deny refuses it. The bot is told not to retry.

You can answer from any device. The bot waits up to ten minutes.

How it decides

With Auto-review on, each action is judged against your rules, your latest message, and built-in checks:

• Asks first: deleting or overwriting, posting where other people see it, anything involving money or access, bulk or irreversible changes.
• Runs: contained, reversible work you asked for.

With Auto-review off, every shell command and every effectful plugin action asks.

Read-only plugin actions never ask, and neither do read-only shell commands: Lorca parses every stage of a command, and one that only reads, such as git status, ls, or rg TODO src | wc -l, runs at once. A command that writes, deletes, installs, runs code, or reads keys and tokens goes to the review model (below), which applies the built-in checks, your rules, and your latest request. Lorca's own folders, ~/.lorca and ~/.lorca-dev, belong to the bots: a command that stays inside them runs without a review, whatever it does there. Temporary folders such as /tmp count as scratch space, so cleaning up there doesn't ask.

The review model

The review model of the bot's own provider reviews its actions. Under Settings › Auto-review › Reviews with you can pick another connected provider to review for every bot instead. Each provider's review model is under Settings › Providers › Review Models. By default it's a small, fast model, such as GPT-6 Luna on ChatGPT or Claude Haiku 4.5 on Anthropic, and you can pick any of the provider's models: a cheaper or a stronger chat model, or a decision model.

A decision model answers a question with probabilities instead of writing text, which makes it fast and cheap. Examples are Jev from TypeSafe, OpenRouter's decision models, and OpenAI's GPT-6 Luna on its Decisions API. It picks allow, or what the action could harm, and Lorca runs the action only when the model is at least 70% sure it's safe. Otherwise the card names the harm. A decision model writes no rule, so its cards offer Allow once and Deny; write rules yourself in Settings. To use one, connect OpenCode Zen, which serves Jev 1.13 (and a free Jev 1.13 Free), or add a decision API as a custom provider.

If the provider you picked is disconnected, the bot's own provider reviews again.

Shell access

An allowed shell command runs as your user with your normal filesystem, process, credentials, and network access. Its working directory is context, not a security boundary. This full-computer access is what lets a skill drive installed CLIs, applications, builds, services, and files outside its workspace.

Auto-review and the permission card are the boundary. Lorca reviews the complete command before starting it; denying a held action means none of its stages run.

Rules

Open Settings › Auto-review to turn it on or off and to write rules in plain language:

When a bot wants to: comment on a pull request → Ask first

When a bot wants to: label issues in my own repos → Allow automatically

Always allow adds its rules here too. When two rules disagree, Ask first wins. Rules sync to all your devices and apply to every bot.

Routines and events

A routine, an event, or a channel's message runs with nobody watching. Actions that Auto-review allows, including those your rules cover, still run. An action that would ask waits for your review instead: it shows under Waiting for review, and runs once you approve it.

What an event or someone in a channel wrote is never taken as your request: Auto-review weighs each action against the task you set up.