Skip to main content
Autopilot is the state where the agent proceeds without stopping for an approval on every tool call. In Continuum today that is not a separate switch — it is one pole of the permission control every Code session carries. The rails that keep it safe are elsewhere: a daemon-side throttle, an inactivity sweep that turns it off, and a hash-only audit log of every toggle.

​
Plan and Code

Permission is a single two-state Plan ↔ Code pill in the composer. There is no separate “Auto” toggle. Code always means maximum permissions, for every provider. Picking Code does not ask you to trust the repo first — the per-repo trust prompt that used to gate it was removed. Plan never bypasses anything, on any provider. Cursor, the one provider with no plan mode of its own, is always on the Code pole and therefore always skips approvals.
The bypass flag itself is mid-session state held in memory. After an app restart or the inactivity sweep below, the approval policy a session spawns with is resolved from the pole the pill is showing, not from that volatile flag — so a session never comes back up silently auto-approving when the chip says Plan, and never comes back up asking for approvals when the chip says Code.
Chat sessions — a surface hidden by default since Continuum focused on Code — sit outside all of this. They run no shell and write no files, so there is nothing for the permission pill to govern.

​
Daemon enforcement

Toggling the underlying flag over the wire (POST /sessions/:id/autopilot) is possible for any peer holding the bearer token, including your iPhone. The daemon layers three checks before it takes effect:
1

Idempotency

The request’s idempotency key is reconciled against the mobile command outbox, so a retried toggle replays the cached response instead of re-executing.
2

Swap throttle

The toggle counts as a swap and must pass the 1-per-5-second limit. A denial returns HTTP 429.
3

Code sessions only

A Chat session is rejected with HTTP 400. There is nothing to auto-approve.
Every accepted toggle — and its repo — is written to the audit log. When the session runs on a managed harness (Codex, Cursor, Grok, Antigravity), the running bridge is respawned in place so the new approval policy applies to the current turn; a Claude PTY session picks the change up on its next respawn.

​
Inactivity sweep

Skip-approvals does not stay on forever. The daemon ticks every 30 seconds and looks for sessions that have autopilot on and no agent message for 15 minutes. Each one is disabled, the session is paused, and a status event fires so every client clears its indicator. You resume explicitly to continue. This is the guardrail for the failure that actually happens: a session quietly stalls — waiting on a prompt nobody sees, or wedged mid-tool — while still holding permission to act unattended.

​
Rate limits

The daemon throttles mid-session operations per session, as defense-in-depth against a misbehaving or compromised client: Both return a structured HTTP 429. The iOS command outbox treats 429 as transient — the envelope stays queued and retries with exponential backoff (1s, 4s, 15s, 60s, 5min, 30min) rather than surfacing a failure.

​
Running the repo’s own scripts

Skipping approvals and running a repo’s own scripts are two different grants, and only one of them was relaxed. The review pane’s Preview tab — and the same action reached from a paired device — resolves a repo’s conductor.json setup and run scripts, or a package.json dev script, and executes them through /bin/zsh -lc as you. That is arbitrary repo-authored code, so it stays gated on a per-repo execution trust list, persisted to:
An untrusted repo is refused before anything runs. A session sitting on the Plan pole is refused too, even on a trusted repo — a deliberately read-only review session cannot be turned into repo-script execution over the wire.

​
Audit logs

Every sensitive write is recorded as hash-only JSONL — prompt text is SHA-256’d with a byte count, no plaintext, no PII — under an owner-only (0700) directory:
Hash-only is the default. You can opt into plaintext capture with the UserDefault clawdmeter.audit.includePlaintext (Settings → Privacy → “Audit log: include plaintext”) — off by default.
Each stream rotates at 1 MB or 7 days, whichever comes first; the rotated archive is timestamped (<kind>.<iso8601>.jsonl). On daemon startup the last 256 entries of mobile-commands.jsonl — current file plus the most recent archive — are replayed to re-seed the idempotency cache, so retries still in flight from your phone are caught after a restart.

​
Diagnostics

Settings → Diagnostics has a segmented control with two surfaces:
Browse the prompt-send, swap, and autopilot streams with a text and session-ID filter. Tap an entry to expand its raw JSONL. Support Bundle exports a redacted copy of the audit folder for sharing.
  • Sessions — session lifecycle and the daemon registry.
  • Plan mode — what the Plan pole actually does.
  • Mobile — the command outbox and its retry behavior.
  • Security — the wider trust model this sits inside.