GUIDE
How to use Intern
Everything you will actually run into, in the order you will run into it — from the SmartScreen warning to a shared team folder.
01
Before you start
Intern reads a document and tells you what to call it.
For each document it proposes a filename that starts with the date, describes what the document concerns, and names the parties involved.
- It shows its work
- Every fact in a proposed name comes with the verbatim excerpt from the document that supports it, plus a confidence.
- It doesn't guess
- Anything it cannot back up with the document's own text goes to a review list instead.
- It stays on your machine
- Reading, OCR, and the AI model all run locally. Your documents never leave the computer, unless you turn on a hosted model (opt-in, your own API key).
Intern never asks for a password — not even for OneDrive or SharePoint, which it reaches through folders already on your disk (see section 06).
It makes two kinds of network request, and neither carries anything about your documents: the one-time model download, which you start, and the update check, which runs when Intern starts and every 6 hours while it runs, and whenever you press Check for updates. You can switch the automatic check off (section 10).
The one exception is yours to make: Settings can send documents to a hosted model under your own API key. It is off unless you turn it on, and the header says so while it is (section 03).
WHAT YOU NEED
- Windows 10 or 11, 64-bit (x86-64).
- About 1.5 GB of free disk space for the app and the AI model file.
- No administrator rights. Intern installs per user.
02
Install it
Three steps, and one warning screen that is expected.
-
Download the installer.
Get
Intern_<version>_x64-setup.exefrom the download page. -
Click through the SmartScreen warning.
Windows shows “Windows protected your PC” and the words “unrecognized app”. Choose More info, then Run anyway.
-
Let it install.
It installs for your user only — no administrator prompt, no IT ticket.
The installer is not Authenticode signed yet, because this project has no code-signing certificate. Don't take an unrecognized-app warning lightly in general — verify the download rather than trust it.
On a PC where Smart App Control is on (enforcement mode), Windows blocks the installer outright and offers no Run anyway. Intern cannot be installed there until it is signed.
Every published installer carries an attestation proving which repository, workflow, and commit produced those exact bytes. Check it with the GitHub CLI:
gh attestation verify Intern_<version>_x64-setup.exe --repo z-brenner/intern --signer-workflow z-brenner/intern/.github/workflows/release.yml
SHA256SUMS.txt, published beside the installer, catches a
corrupted download — but it sits on the same page as the installer, so
it proves nothing about origin. The attestation is the part that does.
03
First launch
The installer deliberately leaves out one thing: the AI model file, 1.19 GiB.
The first time you open Intern, a setup screen asks to download it.
- It resumes
- If the connection drops, reopen Intern and the download continues where it stopped.
- It is verified
- The file becomes active only once its exact length and SHA-256 match the manifest built into the installer, so a broken or tampered download cannot be used.
- You can bring your own
- Choose existing model files points Intern at a copy from another machine and skips the download. This is also how you install on a machine with no internet at all.
- Or use a hosted model
-
Set up a hosted model on the setup screen — or the Model section in Settings later — lets Intern use Anthropic, OpenAI, or any OpenAI-compatible service (including a local server such as Ollama or LM Studio) under your own API key, with no download.
Understand the trade: the text Intern reads from each document is sent to that service. The header badge changes from Private · On this device to Hosted model · Text leaves this device for as long as it is on. The key is kept in your operating system's credential manager under “Intern”, never in Intern's files, and Test connection sends only Intern's own calibration page.
Nothing else needs installing. PDF reading, OCR, and inference all ship inside the app.
04
Your first document
Start with one file you already know, so you can judge the result.
-
Drag one PDF onto the window.
Or use Add files. One document is enough to see the whole flow.
-
Watch it change status.
It goes from Waiting to processing — the row says Reading document…, then Proposing a name… — and lands on Ready or Needs review.
-
Open it and read the evidence.
The inspector shows each fact in the proposed name — the date, the type, the parties — beside the exact words from the document that support it.
-
Approve it.
Only now is anything renamed on disk. Changed your mind? Undo it from Completed.
05
Everyday use
Drag files or folders onto the window, or use Add files and Add folder.
FORMATS IT READS
- Word .docx .doc .rtf .odt
- PowerPoint .pptx .ppt .odp
- Excel .xlsx .xls .ods
- CSV exports
- Email .eml
- Outlook .msg
- Plain text
- Markdown
- PNG
- JPEG
- TIFF
- Approving in bulk
- Approve one document at a time, or use Apply all ready. After either, a note at the foot of the queue says what was renamed and offers Undo for ten seconds; it puts back every rename that batch made. Every rename can also be undone later from Completed.
- Reviewing from the keyboard
- J and K (or the arrow keys) move through the queue, Enter or F2 goes to the proposed name, Ctrl+Enter approves it, Alt+K keeps the original name, Delete removes the document after asking, and / jumps to the filter. After each decision Intern moves on to the next document still waiting for you.
- Send to Intern
- The installer adds Intern to Explorer's Send to menu. Select documents — attachments saved from Outlook, a folder of scans — right-click, and choose Send to > Intern. They join the queue whether or not Intern is already open. A file Intern cannot read is left out and named in the window with the reason; everything else is queued.
- Your organisation's names
- Your own firm's name is on almost everything you file. List it under Your organisation's names in Settings, one name per line, and a document that names your firm and someone else is named after the other side and, with By first party, filed in the other side's folder. The review panel says which party was left out, and the evidence still shows it. A name shorter than four letters is too short to match safely and is not used.
- Every name has a date
- A rename is refused unless the name starts with the document's date as YYYY-MM-DD. When Intern could not verify the date the model read, review shows it, says so, and Use date & rename accepts it in one click; Use this date puts it in the field to edit first. When the model offered none, every date the document states is a button, with the file's own date last and labelled as such.
- Spellings Intern learns from you
- The document says “Contoso Worldwide, Inc.”; you call it “Contoso”. Respell a party or a document type in review and Intern remembers it. The second time you make the same change it becomes the spelling Intern uses for every later document that names the same thing, and the review panel says Uses your spelling under the name. Settings lists everything learned, with Use now for a spelling you want at once and Forget for one you do not. The evidence always keeps the document's own words.
- Duplicates
- A document whose content Intern has already filed is flagged as a duplicate of the filed name, rather than renamed again. Choose Process anyway to process it all the same. A second scan, a re-export, or a copy saved again is not the same bytes, so Intern also compares the words: a document that says what a filed one says, dated the same, waits in review with Filed already as and the name — on this computer or a teammate's. Approve to file it anyway, keep the original, or remove it.
- Where files land
-
Settings has a destination folder. Leave it empty and files are renamed in place; set it and renamed files are moved there.
Arrange filed documents can sort them into subfolders by year, by year and type, by type, or by first party. Folders appear as documents arrive and go away again when an undo empties them.
- Finding a document
- A long queue has a filter box above it. Type part of a filename or a word from the description; Esc clears it.
- In the tray
- With Run in the background on, the tray icon's tooltip says how many documents need review or are ready to rename.
Intern runs a roughly 2-billion-parameter model on your CPU, one document at a time. Leave it working through a stack — that pace is the price of nothing leaving your machine.
06
OneDrive & SharePoint
Intern works through the folders the Microsoft sync client already keeps on your disk.
The build published here never talks to Microsoft's servers: it ships with no deployment to sign in to, so it never asks you to sign in, holds no token, and uploads nothing. Renamed files reach the cloud through the OneDrive app you already run.
SET UP A FOLDER: THREE CLICKS
The first time Intern opens it offers to watch a folder for you; later, open Settings and choose Set up a folder step by step… under Shared intake. Nothing asks for a tenant, a site, or an account. First make sure the folder is on your disk: your own OneDrive already is, and for a SharePoint library you open it in the browser and click Sync or Add shortcut to My files.
-
Choose a folder.
Intern lists the OneDrive and SharePoint folders already on this computer, such as Legal - Documents or OneDrive – Contoso. Use one, or browse to a folder inside it. Folders synced with Sync, folders added with Add shortcut to My files, and your own OneDrive all work. If none is listed, click Sync (or Add shortcut to My files) in SharePoint and choose Check again.
-
Say where renamed documents go.
Intern creates a Filed folder next to the one you chose, or you choose another. Choose the top folder of a synced location and Intern makes an Inbox to watch and a Filed folder inside it, so renamed documents stay synced.
-
Decide about what is already there.
If the folder already holds documents, Intern asks once whether to rename them too. The default is to rename only new ones.
Choosing it here is how Intern knows the documents in it are yours, so it does not ask Microsoft who uploaded them. Intern then keeps running in the system tray and starts when you sign in, so documents are filed while its window is closed.
A synced folder chosen that way has not been vouched for, so its documents are held as uploader unknown and none is renamed: the published build cannot ask Microsoft who uploaded them. Use Set up a folder step by step… instead.
Settings shows how the folder is doing — up to date, waiting for OneDrive to download documents, OneDrive not running, or no longer synced — with the one button that fixes each. A document whose contents are still in the cloud is never renamed or moved until OneDrive has downloaded it. Intern labels a folder you pick “Synced with OneDrive – …”, “Synced with SharePoint – …”, or “On a network share – …”, and Settings lists every synced location on this computer, because the folder a library syncs to has a name nobody chose. A network share can never be watched as your own: anyone with access can add to it.
DESCRIPTIONS IN A SHAREPOINT COLUMN
Alongside the filename, Intern writes one sentence saying what the document concerns. It can leave that sentence beside each document it files, so a column of the library can show it.
-
Turn on the records.
In Settings, under Descriptions for SharePoint, tick Write a description record for each filed document and save. It needs a destination folder, because that is where the records live.
-
Intern writes one small file per filed document.
Under
.intern\descriptionsin the destination folder: the new filename, its path in the library, the sentence, and the date, type, and parties behind the name. Never any document text. The sync client uploads it like any other file. Intern makes no network request for this. -
A flow fills the column.
Add a Description column to the library and create the Power Automate flow described step by step in the description-column guide. It runs under the account of whoever creates it and copies each record's sentence into the column.
Turned it on after filing a stack of documents? Write records for documents already filed in the same section writes them now. No flow? The rename history's CSV export has the sentence in its last column, ready to paste into the library's grid view.
TWO THINGS PEOPLE ASK
Some files show a cloud icon in Explorer instead of a green tick
That is Files On-Demand, and it is handled. The read Intern performs is exactly what makes OneDrive fetch the content. If the machine is offline, the document waits and is picked up once the content arrives, rather than being failed.
I have files named “conflicted copy” — will Intern rename those too?
No. Files like report (Jane's conflicted copy …), or
a name suffixed with a teammate's machine, are OneDrive's conflict
bookkeeping — not new documents.
Intern counts them in Settings and leaves them alone. Resolve the conflict in the folder and the surviving file is picked up.
07
Watch a folder
A plain folder on this computer works too: tick This is a private local intake.
-
Choose the folder.
In Settings, under Shared intake, turn on Watch a folder for new documents and choose the intake folder.
-
Say it is yours.
Tick This is a private local intake, not a shared or synced folder. That tells Intern only you put documents there, so it processes them without asking anyone who added them. The box is refused for a OneDrive, SharePoint, or network-share folder; for those, use Set up a folder step by step… (section 06).
-
Choose a destination and save.
Renamed documents go to the destination folder.
A watched folder that is neither set up step by step nor ticked as a private local intake is treated as shared: its documents are held as uploader unknown until Microsoft confirms who uploaded them, which only a provisioned build can do. Settings counts them.
Two rules are enforced when you save, rather than discovered while running:
- Watching requires a destination folder.
- The destination must be outside the intake folder. Renaming in place inside a watched folder would make every result reappear as new work, so Intern refuses that configuration up front.
- Scan interval
- About every 20 seconds, and every few seconds while a file is still arriving. Scan now forces an immediate pass.
- Half-copied files
- A file is only picked up once its size and modified time have held still for about ten seconds, so a file still being copied is never read. Scan now does not shorten that wait.
- Folders you cannot open
- A subfolder this account has no permission to read is counted in Settings and skipped. Everything else is still scanned — one locked folder on a share never stops the rest.
08
Working as a team
A team Inbox that files what your colleagues upload needs a build your administrator provisioned.
In that build Intern connects your Microsoft work account and reads, from Microsoft's own file metadata, who uploaded each document — never its content. Only documents you upload directly into the Inbox, unchanged, are filed for you. Anything uploaded by someone else, or that cannot be verified, stays untouched in the Inbox. The build published here has no deployment, so it cannot verify anyone; use a folder only you add documents to (section 06).
Several computers can watch the same synced folder. They coordinate
through a .intern folder inside it — small files the sync
client replicates like anything else. Don't delete .intern
casually; it is how machines avoid processing the same document twice.
- One claim per document
- First claim wins, with a time-limited lease. If a machine crashes, its work is taken over automatically once the lease lapses — about 15 minutes. Sync-based leases are best effort, not an exactly-once guarantee.
- Shared work queue
-
By default each machine only processes its own verified uploads.
In a provisioned build, Also process documents uploaded by others accepts other verified uploaders' documents too — never unknown ones — with a two-minute courtesy delay, so the uploader's own machine gets first claim. Without a provisioned build there is no one it can verify, so it adds nothing.
- Who is doing what
- Name your machine in Settings under This machine's name, so teammates can tell the machines apart.
- The same document twice
- The shared folder remembers what every machine has filed out of it, for a year. A document someone uploads again — under any name — is flagged as a duplicate of the filed name, naming the machine that filed it, instead of being filed a second time.
To everyone who can see the folder: filenames, including the names documents were filed under, file sizes, machine names, and usernames. Never document content, text, or AI output.
09
Troubleshooting
Find the sentence that sounds like your problem.
INSTALLING AND UPDATING
Windows says “Windows protected your PC” and won't run the installer
Expected — the installer is not Authenticode signed. Click More info, then Run anyway. If in doubt, verify the download first with the attestation command in section 02.
Windows blocked the installer and there is no Run anyway
That is Smart App Control in enforcement mode, which blocks unsigned installers outright. The Intern installer is not Authenticode signed yet, so it cannot be installed on that PC until it is. Turning Smart App Control off is a decision about the whole computer, not one to make for one app.
The model download stopped partway through
Reopen Intern — the download resumes where it stopped. The file is verified against its exact length and SHA-256 before it is ever used, so a broken download cannot be used by accident.
Check for updates fails
It is the only network call Intern makes besides the model download (and a hosted model, if you chose one, or Microsoft, in a build provisioned for a team), so check your connectivity. An update that is not signed by this project's key is refused outright — that is deliberate.
Intern must not contact anything on its own
Untick Check for updates automatically in Settings → Updates and save, and keep the local model rather than a hosted one: with a hosted model, each document's text is sent as the document arrives, watched folders included, without a click. Intern then makes no request you did not ask for; Check for updates still works when you press it (section 10). A build provisioned for a team also asks Microsoft about each upload to its Inbox; the build published here ships with no deployment, so that code never runs and never contacts Microsoft.
NAMING AND THE HOSTED MODEL
Approve says every rename needs a date
Intern never files an undated document. Start the filename with the document's date as YYYY-MM-DD — or, when the review panel offers the date the model read, use Use date & rename. A document with no date anywhere can be kept under its original name instead.
Intern says a document was filed already, but it is a different one
The two say nearly the same words and carry the same date, which is what a second scan or a re-export looks like. Intern will not file it on its own, but it is your call: Approve & rename files it beside the other. Two documents that differ in their date are never confused this way.
Intern keeps using a spelling I do not want
It learned it from two of your own edits. Open Settings, find the spelling under Spellings Intern has learned, and choose Forget: documents still waiting go back to the document's own words at once, and names already applied stay as they are. Changing a learned spelling back to the document's own words in review forgets it too.
The queue paused with a hosted-model error
A rejected key or an unreachable service would fail every document in turn, so Intern pauses instead and says which it was. Open Settings, use Test connection until it succeeds, then press Resume. An account that cannot pay is the next entry. A document the hosted model declined to read is not a pause: it fails on its own, and the rest carry on. Rename that file yourself, or retry it.
The hosted model reported a billing or quota problem
Intern pauses the queue once instead of failing every document against an account that cannot pay for them. Nothing is lost: the documents wait in the queue. Sort out the billing or the quota with the provider, then press Resume, the play button beside Add folder.
DOCUMENTS
A document went to “Needs review” — did something break?
No. It means one of the facts in the proposed name could not be matched word-for-word in the document.
The review reason names which one: the date, the document type, a party, or the description.
Fix the name yourself in the inspector and approve it, or choose Keep original.
It says the document is open in another program
Something still has the file open: the program you opened it in to check it, or the sync client, mid-upload. Intern already waited a few seconds for it to let go, then put the rename back as it was. Close the document, or let the sync finish, and approve it again.
A document failed twice and stopped trying
It is in Failed, with the reason shown. Retry it manually from there.
Everything is slow
Local CPU inference is the price of nothing leaving your machine. Tens of seconds per document is normal, and the app processes one document at a time on purpose.
FOLDERS AND SYNC
The SharePoint column stays empty
Check three things in order. Settings → Descriptions for
SharePoint says On and shows the records folder; the
folder .intern\descriptions exists in the library
(open it in the browser — if it is missing, the sync client has
not uploaded it yet); and the flow's run history shows it ran.
A record can arrive before its document. The recipe's retry handles that; a flow built without it fails once and needs a re-run.
Settings says “subfolders could not be read”
The intake folder has a subfolder this Windows account cannot open — common on a shared drive where permissions are set per folder. Documents in it are not seen; everything else is. Ask for read permission on that folder, or move the documents out of it.
Settings says documents are “uploader unknown” and nothing is renamed
The watched folder was chosen by hand, so Intern does not know the documents in it are yours and is waiting for Microsoft to say who uploaded them — which the published build cannot ask. For a OneDrive or SharePoint folder, run Set up a folder step by step… in Settings and pick the same folder (section 06). For a plain local folder, tick This is a private local intake (section 07).
A file in my watched folder is being ignored
Work through the usual causes:
- Is it a supported format? Is it zero bytes?
- Is it still copying or syncing in? A file is only picked up once its size and modified time have held still for about ten seconds.
- Is it a dot-file, an Office lock file starting with
~$, or Intern's own history export (intern-history….csv)? Those are ignored on purpose. - Did another machine claim it? Settings shows the counts.
Then try Scan now.
The watched folder settings won't save
The destination folder must exist and must be outside the intake folder. Intern refuses the loop at save time and tells you which rule was hit.
A cloud file failed while I was offline
It is held, not abandoned. Reconnect, and it is retried automatically on a later scan once the content arrives.
GOOD TO KNOW
Where does Intern keep its own data?
In per-user app data. Your documents stay where they are. Uninstalling removes the app but leaves both your documents and Intern's data alone.
Can I use it with no internet at all?
Yes — after install and the model download, or by using Choose existing model files with a copy of the model from another machine. OneDrive folders keep working locally and sync whenever the sync client next connects.
10
Updates
Intern checks for a newer release when it starts and every 6 hours while it runs.
The check asks GitHub for the release manifest and sends nothing about your documents: no filenames, no contents, no identifier. A found update shows a banner; nothing is downloaded or installed until you click Install … and restart, which shows how much of the download has arrived. Only a build signed with this project's key is accepted; anything else is refused. Installing waits for renames: once the download is in, the queue pauses so it starts no more, and a rename part-way through its move, even one that began during the download, finishes before Intern closes for the installer.
- To stop the automatic check, untick Check for updates automatically (when Intern starts and every 6 hours) in Settings → Updates and save.
- To check right now, press Check for updates in the same place. It works whether the automatic check is on or off.