Modes & permissions

A mode answers one question: what may Lino AI do without asking you first? Under the mode, a sandbox keeps commands inside the folders you gave Lino AI, and anything beyond that comes to you as an approval card in the chat.

Choose a mode

Click the mode button under the composer (it shows the current mode, e.g. Auto). Hover a row to read its description.

Mode	Description in the app	Changes to your work	Commands
Auto (default)	Edits and runs on its own; a review checks commands that leave the sandbox.	Applied at the end of the reply	Run in the sandbox without asking; leaving the sandbox goes to the Auto review first
Manual	Asks before changing anything that isn't its own.	Wait for you to press Apply	Asks you
Accept edits	Edits on its own, asks before running things.	Applied at the end of the reply	Asks you

In every mode, new things Lino AI makes, and edits to its own work, land right away, and everything can be undone from the review card. See Changes, review & undo.

When to pick which:

Auto — everyday work. Stopping to confirm each small change would cost more than it protects.
Manual — when you want to see every change to your own Cards before it happens.
Accept edits — writing sessions where you are happy with edits but want a say in anything that gets run.

The mode is a setting on this device and applies to all chats.

Plans come on demand

There is no Plan mode or Plan switch. Lino AI makes a Plan Card when work will outlast the reply or needs your decisions, and you can always ask for one ("make a plan first", "ask before you start", "just do it"). A plan changes no permission. See Plans.

Bypass permissions

Under Auto only, a switch called Bypass permissions — Runs without warnings. Still asks at a door. It appears only after you turn on Settings → Permissions → General → Allow bypass permissions.

It removes the warnings in between, not the doors: Lino AI still asks before running a command outside the sandbox, lending a site login, or changing a Skill, and the sandbox and your folders are unchanged. Turning the setting off also turns the switch off.

The sandbox

Every command Lino AI runs is confined by the operating system:

It can write only in the Canvas's folder (and folders you granted).
It cannot read your other files or credentials — .env files, SSH keys and the like — even inside those folders.
It cannot reach the network without asking (see Websites).
Tool caches (npm, pip, uv…) live in Lino's own cache folder, so installs work without opening your folders to the sandbox.

Folders

A Canvas's folder is where Lino AI works for that Canvas, and the only place it can change files.

Bind a folder: hover the Canvas in the sidebar and click the No folder chip (Bind a folder), or choose Bind a folder... from the Canvas's menu. Change or remove it later with Change folder... / Unbind folder. See Canvas Binding.
Attach a folder for one chat: + → Folder in the composer. You are asked Let the assistant read and change things in this folder?
When a command needs another folder (say, saving into Downloads), Lino AI asks for that folder with an Allow card. Only folders inside your home folder are offered this way — never the home folder itself, a hidden folder or Library.
No folder at all: Lino AI still has a scratch folder for the Canvas, in Lino's cache. Commands run there and new files go there without asking. It is temporary and only on this computer; scratch folders untouched for 30 days are cleared when Lino starts.

All bound folders are listed in Settings → Permissions → File access → Canvas folders, where you can Choose another folder or Unbind.

To keep certain files in a folder away from Lino AI, use a .linoignore file. See Privacy & what is sent.

Approval cards

When Lino AI needs a permission it doesn't have, the reply pauses and shows a card. Most cards have Stop (end the reply), Deny… (say why not, so it can try another way) and an allow button.

Card	What it asks	Buttons
Approve this command	A command that your mode asks about	Allow once, Always allow … (a pattern, e.g. `npm test`)
Run outside the sandbox	A command that can't work inside the sandbox — installing a program, installing a Skill from an address, pushing over SSH, Docker. The full command is shown	Run once (no "always" for this)
A command is connecting to the internet	A website a command wants to reach. Your answer holds for every chat until Lino quits	Deny, Allow site
Folder	Read and change a folder you haven't opened to it	Allow
Make this change? / Create this file? / Install this skill? / Change this skill?	A change shown to you as a diff first: a Skill, a folder you opened read-only, or a file that runs on its own later (git hooks, editor tasks, shell profiles)	Allow
Use your login for a command?	Borrow your login to one site from Lino's browser	Allow (or Open site / I've signed in if you aren't signed in yet)

Approved outside-the-sandbox commands run as if you typed them in your own terminal.

When something is not done, the task row says why — outside its folders, a protected file, excluded by .linoignore, you declined, stopped by review — and Lino AI is told the same reason.

Websites

A command that connects to a site asks first, by site: "Allow www.youtube.com" holds for every chat until Lino quits. To keep it for good, go to Settings → Permissions → Approvals → Websites and press Keep for good. (Lino AI's own web search and page reading are controlled separately, by Web access in Settings → Capabilities.)

Auto mode's review

In Auto, when Lino AI asks to run a command outside the sandbox, a second model reviews it before you would be asked:

Allowed — it runs, and no card appears.
Stopped — it does not run. Lino AI is told why and tries another way or tells you. The task row says stopped by review.
No answer (the review timed out or made no sense) — you get the normal card.

The review sees what you said and what Lino AI did — not Lino AI's own explanations, and not text from web pages, files or command output, so text planted there can't talk it into anything. If it stopped something you want, say so in the chat ("yes, run the install script from x.example"). After repeated stops, the next one comes to you as a card, with the review's reason on it.

Only commands leaving the sandbox are reviewed. Folders, diffs you see first, websites and site logins still ask you. In Manual and Accept edits nothing is reviewed — you are asked.

Set up the review

The review works better when it knows your setup. Open the mode menu and press Setup on the Auto row, or go to Settings → Permissions → Auto mode → Your setup (Set up).

How you use Lino here — Mixed (most careful), Work, Personal or Open source (least careful).
Choose what it may read:
- Also scan shell history — only the names of commands you run, never their arguments.
- Also scan your other repos — only where each is hosted, never what is in it.
- Import from Claude Code / Import from Codex — shown only if found: what you already told those tools about your setup. From folders bound to a Canvas it reads only names from .env files and CI workflow files (for example which variables and secrets exist) — never their values, and never other file contents.
Press Continue. It drafts in the background (you can close the dialog; a bubble says when the draft is ready).
Read the draft — What the review will know about your setup: your repositories, servers and sites, and a list of routine commands. Edit it if you like. Routine commands only tell the review what is ordinary for you; they are still reviewed.
Press Apply, or Discard.

Nothing changes until you apply. A waiting draft shows a dot on the Setup button.

Settings → Permissions

Settings → Permissions (under Lino AI) collects everything about what Lino AI may do on this computer. It is kept on this device only and never synced.

Section	Row	What it does
General	Lino AI can change without asking	What it wrote / Anything it has worked on — which edits land without waiting. See Changes, review & undo.
	Allow bypass permissions	Adds Bypass permissions to the Auto menu.
	Site logins	Lets Lino AI ask to borrow a site login from Lino's browser. Off: it never asks.
Auto mode	Your setup	What the review knows. Set up, Set up again or Review draft.
Approvals	Commands	Command patterns you allowed: In this chat and Always allowed.
	Websites	Always allowed, Allowed until Lino quits, Denied until Lino quits.
File access	Canvas folders	Every Canvas with a folder on this computer.

In Approvals, each entry has Keep for good (if not kept yet) and Remove. Long lists show the first five and Show all. You agree to things in the chat; keeping them for good is a second, deliberate step here.