Autopilot and guardrails

Autopilot and guardrails

Autopilot works through a task across several turns without asking about every file read and edit. It runs inside an operating envelope you set before it starts, and you can stop and undo it.

Turn it on

1. Check Autopilot under the message box, on the home screen or in a conversation. Autopilot works in Build mode, so checking it selects Build, and choosing Ask or Plan turns it off.
2. Choose the turn limit and time limit. The text under the message box names your workspace, the limits and what still asks you.
3. Send your task. Turning Autopilot on and sending is your authorization for that task. New conversations start with Autopilot off.

The guardrails

What it may do without asking

• Read and list files inside your workspace.
• Write or edit files inside your workspace, bound to the revision of the file it read. If the file changed since, the edit is refused.
• Run commands that pass the command policy, including eligible builds, tests and installs.

Commands kept for approval

When the command policy recognizes the following operations, or cannot classify a command, it returns the action for your decision. The policy examines the command line, not the contents or behavior of a workspace script.

• Deletes or moves outside the workspace.
• Git push, and history rewrites such as a hard reset.
• Publishing packages and deploying.
• Cloud and payment command line tools.
• sudo, credential stores and secret files.
• Network uploads, and scripts piped from the network into a shell.
• Anything Autopilot cannot classify.

What is refused outright

• Paths outside the workspace.
• Sensitive paths and symbolic links that leave the workspace.
• Inputs over 256 KB, and inputs that look like they contain secrets.

Commands run as you, on your Mac. Build tools, test runners and workspace scripts can execute code with your permissions. The command policy is not an operating-system sandbox and does not contain a script's effects.

Limits

While a task runs, a banner shows the turn, the time left and the action count, for example "Turn 2 of 6, 11:40 left, 14 of 120 actions". Autopilot ends with one of these reasons: Task complete, Turn limit reached, Action limit reached, or The turn failed.

Stop

Select Stop in the banner. Stop revokes Autopilot's authority first, then requests cancellation of the turn, so no further file change is approved automatically. An operation already approved or started may have effects that cancellation cannot undo.

Undo

Before the first change to a file in a turn, Hypheus saves a checkpoint of its content (files up to 1 MB). When the task ends, a review lists each changed file with its diff and every command that ran, and offers:

• Undo all Autopilot changes;
• Undo from turn N;
• Keep changes.

After an undo, Hypheus reports how many files were restored and which were skipped because you changed them since. It does not overwrite your later edits. Command effects are not undone by a rollback.

What Autopilot is not

It is bounded authority over one workspace for one task. It is not a sandbox and not unrestricted background execution. Each automatic decision keeps its approval identifier and digest in the conversation, so you can review what happened.