> ## Documentation Index
> Fetch the complete documentation index at: https://continuum-three-olive.vercel.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Autopilot & Safety Rails

> How the Plan / Code permission pill works, plus the rate limits, inactivity sweep, and audit log behind unattended agent runs.

Autopilot is the state where the agent proceeds without stopping for an approval on every tool call. In Continuum today that is not a separate switch — it is one pole of the permission control every Code session carries. The rails that keep it safe are elsewhere: a daemon-side throttle, an inactivity sweep that turns it off, and a hash-only audit log of every toggle.

## Plan and Code

Permission is a single two-state **Plan ↔ Code** pill in the composer. There is no separate "Auto" toggle.

| Pole     | What the agent may do                          | How it reaches the provider                                                                                                                                       |
| -------- | ---------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Plan** | Read-only until you approve a plan             | Claude `--permission-mode plan`; Codex `-s read-only`                                                                                                             |
| **Code** | Maximum permissions — approval prompts skipped | Claude `--dangerously-skip-permissions`; Codex `--dangerously-bypass-approvals-and-sandbox`; managed harnesses get always-approve plus the file-system capability |

**Code always means maximum permissions, for every provider.** Picking Code does not ask you to trust the repo first — the per-repo trust prompt that used to gate it was removed. Plan never bypasses anything, on any provider. Cursor, the one provider with no plan mode of its own, is always on the Code pole and therefore always skips approvals.

<Note>
  The bypass flag itself is mid-session state held in memory. After an app restart or the inactivity sweep below, the approval policy a session spawns with is resolved from **the pole the pill is showing**, not from that volatile flag — so a session never comes back up silently auto-approving when the chip says Plan, and never comes back up asking for approvals when the chip says Code.
</Note>

Chat sessions — a surface [hidden by default](/docs/surfaces/chat) since Continuum focused on Code — sit outside all of this. They run no shell and write no files, so there is nothing for the permission pill to govern.

## Daemon enforcement

Toggling the underlying flag over the wire (`POST /sessions/:id/autopilot`) is possible for any peer holding the bearer token, including your iPhone. The daemon layers three checks before it takes effect:

<Steps>
  <Step title="Idempotency">
    The request's idempotency key is reconciled against the mobile command outbox, so a retried toggle replays the cached response instead of re-executing.
  </Step>

  <Step title="Swap throttle">
    The toggle counts as a swap and must pass the 1-per-5-second limit. A denial returns `HTTP 429`.
  </Step>

  <Step title="Code sessions only">
    A Chat session is rejected with `HTTP 400`. There is nothing to auto-approve.
  </Step>
</Steps>

Every accepted toggle — and its repo — is written to the audit log. When the session runs on a managed harness (Codex, Cursor, Grok, Antigravity), the running bridge is respawned in place so the new approval policy applies to the current turn; a Claude PTY session picks the change up on its next respawn.

## Inactivity sweep

Skip-approvals does not stay on forever. The daemon ticks every 30 seconds and looks for sessions that have autopilot on and **no agent message for 15 minutes**. Each one is disabled, the session is paused, and a status event fires so every client clears its indicator. You resume explicitly to continue.

This is the guardrail for the failure that actually happens: a session quietly stalls — waiting on a prompt nobody sees, or wedged mid-tool — while still holding permission to act unattended.

## Rate limits

The daemon throttles mid-session operations per session, as defense-in-depth against a misbehaving or compromised client:

| Action                                                                      | Limit           |
| --------------------------------------------------------------------------- | --------------- |
| Prompt send                                                                 | 1 per second    |
| Model / effort / mode swap, including the autopilot toggle and plan-approve | 1 per 5 seconds |

Both return a structured `HTTP 429`. The iOS [command outbox](/docs/surfaces/mobile) treats 429 as transient — the envelope stays queued and retries with exponential backoff (1s, 4s, 15s, 60s, 5min, 30min) rather than surfacing a failure.

## Running the repo's own scripts

Skipping approvals and running a repo's own scripts are two different grants, and only one of them was relaxed.

The review pane's **Preview** tab — and the same action reached from a paired device — resolves a repo's `conductor.json` setup and run scripts, or a `package.json` dev script, and executes them through `/bin/zsh -lc` as you. That is arbitrary repo-authored code, so it stays gated on a per-repo execution trust list, persisted to:

```
~/.clawdmeter/autopilot-trusted-repos.json
```

An untrusted repo is refused before anything runs. A session sitting on the **Plan** pole is refused too, even on a trusted repo — a deliberately read-only review session cannot be turned into repo-script execution over the wire.

## Audit logs

Every sensitive write is recorded as **hash-only** JSONL — prompt text is SHA-256'd with a byte count, no plaintext, no PII — under an owner-only (`0700`) directory:

```
~/.clawdmeter/audit/
```

| File                    | Contents                                                                    |
| ----------------------- | --------------------------------------------------------------------------- |
| `sends.jsonl`           | Prompt-send and blocked-prompt events                                       |
| `swaps.jsonl`           | Model / effort / mode swaps and plan-approve respawns                       |
| `autopilot.jsonl`       | Autopilot enable/disable events                                             |
| `mobile-commands.jsonl` | Every idempotent write command from the outbox (hashed payload fingerprint) |

<Tip>
  Hash-only is the default. You can opt into plaintext capture with the UserDefault `clawdmeter.audit.includePlaintext` (**Settings → Privacy → "Audit log: include plaintext"**) — off by default.
</Tip>

Each stream rotates at **1 MB** or **7 days**, whichever comes first; the rotated archive is timestamped (`<kind>.<iso8601>.jsonl`). On daemon startup the last 256 entries of `mobile-commands.jsonl` — current file plus the most recent archive — are replayed to re-seed the idempotency cache, so retries still in flight from your phone are caught after a restart.

## Diagnostics

**Settings → Diagnostics** has a segmented control with two surfaces:

<Tabs>
  <Tab title="Audit Log">
    Browse the prompt-send, swap, and autopilot streams with a text and session-ID filter. Tap an entry to expand its raw JSONL. **Support Bundle** exports a redacted copy of the audit folder for sharing.
  </Tab>

  <Tab title="Wire Inspector">
    **Off by default** — toggle it on to start recording. Captures up to 500 request/response pairs (\~5 MB) and polls the rolling buffer once per second, recording both incoming requests and outgoing responses. Body text appears only when the plaintext opt-in above is on; otherwise you get request shape and byte count. Use it to debug client ↔ daemon protocol issues.
  </Tab>
</Tabs>

## Related

* [Sessions](/docs/features/sessions) — session lifecycle and the daemon registry.
* [Plan mode](/docs/features/plan-mode) — what the Plan pole actually does.
* [Mobile](/docs/surfaces/mobile) — the command outbox and its retry behavior.
* [Security](/docs/security) — the wider trust model this sits inside.