Permissions and safety
Approval modes, permission rules, secret files, the sandbox and other safety features.
- Can Line CLI delete my files?Line can delete files with its delete_file tool or shell commands, but asks first in ask mode. /undo restores files it deleted with its own tools.FAQ
- Can Line CLI push to GitHub or deploy my code?Line's git tool is read-only. Pushing or deploying needs a shell command, which asks for approval unless you're in auto mode.FAQ
- Can Line CLI read files outside my project folder?Only if you approve. Reads, lists and searches outside the working folder always ask, except temp folders and folders you allow with --add-dir.FAQ
- Does Line CLI hide my API keys and passwords from the model?Line replaces keys and tokens found in tool output with [REDACTED:kind] before sending it to the model. It's automated and not perfect.Explainer
- Does the model see my environment variables or secrets?Only if a command prints them. Line's own sign-in token is never passed to commands, and secrets in tool output are redacted automatically.FAQ
- How do I approve or decline what Line CLI wants to do?When Line asks, read the command or diff it shows, then approve or decline. Declining tells the agent no, and it tries another way or stops.How-to
- How do I report a security problem in Line CLI?Email support@clatterlabs.com with the Line version, your OS and steps to reproduce. Don't post vulnerabilities publicly first.How-to
- How do I set permission rules (allow, ask, deny) in Line CLI?Add permissions with allow, ask and deny lists to ~/.config/line/settings.json, such as bash(npm test*) or read_file(.env*). Deny always wins.How-to
- How do I stop Line CLI from editing certain files?Add deny rules for edits on those paths, such as Edit(migrations/**), in your settings or the project's .line/settings.json.How-to
- Is it safe to run Line CLI in auto mode?Auto mode is convenient but lets Line run commands without asking. Use it in projects under version control, ideally with rules or the sandbox.FAQ
- Line CLI keeps asking me to approve the same command. How do I stop that?Add an allow rule for that command, like bash(npm test*), switch to accept edits mode for file changes, or use auto mode for trusted work.How-to
- Should I run Line CLI on a production server?Be careful. Prefer a development copy. If you must, keep ask mode, use deny rules and the sandbox, and never use auto mode there.FAQ
- What are Line CLI's approval modes?Line has four modes: ask (default), accept edits, auto and plan. They decide what Line does on its own and what waits for your OK.Explainer
- What does Line CLI send to Clatter Labs?Line sends your prompts, relevant file excerpts, command output and tool results to the model over an encrypted connection, plus version info.FAQ
- What is Line CLI's prompt-injection guard?Web pages, search results and MCP output are treated as untrusted. If they contain instructions to the agent, edits and commands need approval.Explainer
- What is the dont-ask permission mode?In print mode, --permission-mode dont-ask declines anything that would need approval instead of waiting, so scripts never hang.FAQ
- Where can I see every command and edit Line CLI made?Line keeps an audit log of executed commands and edits (with secrets redacted) in ~/.config/line/audit/<date>.jsonl on your computer.How-to
- Why does Line CLI always ask before touching my .env file?Files that usually hold secrets, like .env, SSH and cloud credentials and private keys, always need your approval, even in auto mode.FAQ
Still need help?
Tried the steps above and still stuck? Email us. We usually reply within the first hour, and always within 24 hours. A full support team is with you.
Infrastructure questions, or permanent deletion of your data
infrastructure@clatterlabs.xyzFor deleting your whole account or the data of one service.