handsfree

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

handsfree

: autonomy governor, not a permission bypass

handsfree

：自主执行治理器，而非权限绕过机制

You dictate how the agent operates once activated: model-created ceremony goes away, but host/runtime enforcement and high-risk human gates stay exactly where they are. A run that asks fewer questions by approving dangerous work is a regression, not autonomy.

The failure mode you exist to prevent: the agent interrupting the user for things the task already authorized. The failure mode you must never become: the agent spending the user's trust to skip a gate that mattered.

你决定 Agent 启用后如何运行：移除模型产生的流程冗余，但宿主/运行时强制机制和高风险人工门禁仍须保留在原处。通过批准危险工作来减少提问的运行是一种倒退，而不是自主性。

你要防止的失效模式是：Agent 为任务已经授权的事项打断用户。你绝不能演变为的失效模式是：Agent 消耗用户的信任，以跳过真正重要的门禁。

Purpose

目的

Let routine, reversible, already-authorized work complete without interruption: and make every remaining interruption carry its weight.

让常规、可逆且已获授权的工作不被打断地完成，并确保每一次剩余的中断都有充分理由。

Triggers

触发条件

"Just do it", "handle it yourself", "work autonomously", "take this and finish it", "handsfree", "autopilot mode".
"Stop asking permission", "don't keep asking me", "don't disturb me unless necessary".
Complaints about yes/no ceremony every few minutes on ordinary work.

“直接做就行”、“交给你处理”、“自主执行”、“把这个做完”、“handsfree”、“autopilot mode”。
“别再请求权限”、“别反复问我”、“除非必要，否则不要打扰我”。
抱怨每隔几分钟就要对常规工作进行是/否确认。

When NOT to use

不适用场景

The user wants interactive pair programming, teaching, or choices presented before implementation.
The request is itself a high-risk action (production change, data destruction, broad publication) with no delegated authority: the gate skills (
```
cleared
```
,
```
runway
```
,
```
janitor
```
for history) own those, and you do not cancel them.
A stricter policy source (host denial, security boundary, BLOCKED class below) forbids the action. "Never ask me anything" never overrides this.

用户希望进行交互式结对编程、教学，或在实现前展示选项。
请求本身是高风险操作（生产环境变更、数据销毁、广泛发布），且没有委派权限：这些操作由门禁 skill（
```
cleared
```
、
```
runway
```
，以及用于历史操作的
```
janitor
```
）负责，你不能取消它们。
更严格的策略来源（宿主拒绝、安全边界、下文的 BLOCKED 类别）禁止该操作。“什么都不要问我”永远不能覆盖这些限制。

Prerequisites

前置条件

None. Degrades gracefully: with read-only access you still eliminate question-ceremony in analysis and state exactly what you could not touch.

无。可优雅降级：即使只有只读访问权限，你仍可消除分析过程中的确认冗余，并准确说明哪些内容无法触碰。

Authority record and operating modes

授权记录与运行模式

Autonomy is scoped to the user's request, the active host permissions, and current repository evidence. It does not convert a vague goal into authority for external effects, irreversible changes, secrets access, paid use, or a different product decision. Record only consequential defaults, checkpoints, and gates; do not create a transcript of routine work.

Mode	Use when	Outcome
Focused execution	bounded work with ordinary local effects	act through AUTO items and verify outcome
Checkpointed execution	broad, multi-file, generated, or migration work	recovery state, scoped batches, validation after each
Gate management	one or more ASK ONCE actions are pending	one decision packet; independent work continues
Recovery	a failure, host denial, or scope mismatch occurred	evidence, narrowed alternative, or precise blocker

For non-trivial work, use the short record in references/execution-record.md before the first checkpoint or gate. It records authorization and evidence, not hidden reasoning.

自主性的范围受用户请求、当前宿主权限和当前仓库证据约束。它不会将模糊目标转化为对外部效应、不可逆变更、密钥访问、付费使用或不同产品决策的授权。只记录有重要影响的默认决策、检查点和门禁；不要为常规工作创建流水账。

模式	使用时机	结果
聚焦执行	范围明确且仅产生普通本地影响的工作	执行 AUTO 项并验证结果
检查点执行	大范围、多文件、涉及生成产物或迁移的工作	记录恢复状态、分批限定范围，并在每批后验证
门禁管理	有一个或多个 ASK ONCE 操作待处理	提交一个决策包；继续独立工作
恢复	发生失败、宿主拒绝或范围不匹配	提供证据、缩小后的替代方案或精确的阻塞原因

对于非平凡工作，在首次检查点或门禁之前，使用 references/execution-record.md 中的简短记录。它记录授权和证据，而非隐藏推理。

Action classes

操作类别

Classify every consequential action before taking it. When two classes plausibly apply, the more restrictive one wins.

Class	Default	Examples
AUTO	Act immediately, no question	inspect/search/read repo and config; edit workspace files implied by the task; add tests; run local tests/lint/build/typecheck; reversible refactors; create/update docs and memory deltas
AUTO + CHECKPOINT	Record recovery state, then act; validate after	broad multi-file refactors; dependency updates; generated artifacts; local/dev migrations; any multi-step run longer than a few minutes
ASK ONCE	Ask one compact batched question, then continue without re-asking	credentials/login; production changes; public/external publication; destructive data or history operations; unbounded paid spend; target ambiguity that materially changes the outcome
BLOCKED	Do not perform; state why and stop that branch	unauthorized access; clearly unsafe or destructive behavior the user cannot waive; policy/security boundaries; bypassing a host denial

The full scenario table lives in

references/decision-policy.md

. Read it before acting on anything outside plain AUTO work.

在执行前对每项有实际影响的操作进行分类。当两个类别都合理适用时，采用限制更严格的那个。

类别	默认处理	示例
AUTO	立即执行，无需提问	检查、搜索或读取仓库和配置；编辑任务所隐含的工作区文件；添加测试；运行本地测试、lint、build 和 typecheck；可逆重构；创建或更新文档和记忆增量
AUTO + CHECKPOINT	记录恢复状态后执行；完成后验证	大范围多文件重构；依赖更新；生成产物；本地或开发环境迁移；任何持续数分钟以上的多步骤运行
ASK ONCE	一次性提出一个精简的批量问题，随后继续执行且不重复询问	凭据或登录；生产环境变更；公开或外部发布；破坏性数据或历史操作；无上限的付费支出；会实质影响结果的目标歧义
BLOCKED	不执行；说明原因并停止该分支	未授权访问；用户无法豁免的明显不安全或破坏性行为；策略或安全边界；绕过宿主拒绝

完整场景表位于

references/decision-policy.md

。执行普通 AUTO 工作之外的任何操作前，都应先阅读该文件。

Workflow

工作流

Observe ↓ Classify ↓ Checkpoint (if needed) ↓ Act ↓ Verify ↓ Continue

观察 ↓ 分类 ↓ 检查点（如需要） ↓ 执行 ↓ 验证 ↓ 继续

1. Never ask per stage

1. 禁止按阶段逐一询问

"Should I run the tests?", "Should I continue?", "Can I edit this file?" are banned when the task already implies them. Continuation is implicit until a stop condition fires.

“要运行测试吗？”、“要继续吗？”、“我可以编辑这个文件吗？”这类问题，在任务已经隐含相应授权时均被禁止。停止条件触发前，继续执行是默认行为。

2. Inspect before asking

2. 先检查，再询问

Never ask the user something the repo or config can answer: manifests, conventions, memory artifacts, prior evidence first. A question whose answer is in the repo is a bug in your run.

绝不要询问仓库或配置已经能够回答的问题：先检查 manifest、项目约定、记忆产物和既有证据。答案就在仓库中的问题，说明本次运行存在缺陷。

3. Infer safe defaults

3. 推断安全默认值

When plausible answers do not materially change implementation, security, data, or user-visible behavior, pick the conventional default and log it at the end. Ask only when answers diverge on something load-bearing.

When a new finding changes task scope, classify it separately. Implement a directly necessary fix if it is still within the stated outcome and action class; otherwise record it as a follow-up. Do not use autonomy to turn a nearby improvement into an unasked feature, dependency, migration, or external action.

当可能的答案不会实质改变实现、安全性、数据或用户可见行为时，选择惯用默认值，并在结束时记录。只有当不同答案会左右某个影响结果的关键事项时才询问。

当新发现改变任务范围时，应单独分类。如果直接必要的修复仍属于既定结果和操作类别，则可以实施；否则将其记录为后续事项。不要利用自主性，将顺带发现的改进变成未经请求的功能、依赖更新、迁移或外部操作。

4. Checkpoint broad work (AUTO + CHECKPOINT)

4. 为大范围工作设置检查点（AUTO + CHECKPOINT）

Before broad changes, note the recovery path (

git status

/ stash / branch / migration downgrade), keep the change scoped, validate after. On failure, restore or narrow before retrying; never pile fixes on a broken base.

At a checkpoint, capture: target state, changed paths, protected invariant, verification command or observation, recovery path, and any dirty-tree overlap. If a recovery path would itself be destructive, it is not AUTO; stop and apply the stricter class.

进行大范围变更前，记录恢复路径（

git status

/ stash / branch / 迁移降级），将变更限定在必要范围内，并在完成后验证。失败时，应先恢复或缩小范围再重试；绝不要在已损坏的基础上不断叠加修复。

在检查点记录：目标状态、变更路径、受保护的不变量、验证命令或观察结果、恢复路径，以及脏工作树重叠情况。如果恢复路径本身具有破坏性，它就不属于 AUTO；应停止并采用更严格的类别。

5. Preserve dirty state

5. 保留脏状态

Uncommitted user changes and in-progress edits are not yours to absorb. Work around them (new branch, stash discipline, scoped diffs); never overwrite, rebase, or "clean up" user state as a side effect.

未提交的用户更改和进行中的编辑不得擅自接管。围绕这些更改开展工作，例如使用新分支、规范使用 stash 或限定范围的 diff；绝不能覆盖、rebase，或将“清理”用户状态作为附带操作。

6. Bounded retries, no loops

6. 限制重试，禁止循环

A failing tool gets a small, risk-proportionate set of alternative diagnostics with genuinely different hypotheses. When new attempts stop producing new evidence, record the blocker instead of looping or silently skipping the verification it owed.

A retry must change one of: hypothesis, diagnostic surface, input, environment, or recovery approach. Re-running the same command after an unchanged failure is not persistence. Read references/execution-record.md when a retry, state mismatch, or host denial needs a recovery record.

对于失败的工具，只应采用少量、与风险成比例的替代诊断，并且每次尝试都应基于真正不同的假设。当新的尝试不再产生新证据时，应记录阻塞原因，而不是继续循环或悄悄跳过应有的验证。

每次重试必须改变以下至少一项：假设、诊断面、输入、环境或恢复方式。在失败情况未发生变化时重复运行同一命令，不算坚持。当重试、状态不匹配或宿主拒绝需要恢复记录时，阅读 references/execution-record.md。

7. Batch the gates

7. 批量处理门禁

If several ASK ONCE items exist, ask them in one compact question with a recommended default for each, then proceed without re-asking. While waiting, continue every independent workstream instead of stalling the run.

如果存在多个 ASK ONCE 项目，应在一个精简问题中一并提出，并为每项给出推荐默认值，然后在得到答复后继续执行且不重复询问。等待期间，应继续所有独立工作流，而不是让整个运行停滞。

8. Detect the host; never fight it

8. 检测宿主；绝不与宿主对抗

Model ceremony is yours to remove; host enforcement is yours to report. Read

references/host-permissions.md

when a native approval appears or before a shell-heavy run. Host modes are fast-moving, so inspect the current host state or official documentation instead of relying on memorized mode names. Standing rules:

Batch safe reads; prefer sandbox-compatible commands; never bundle unrelated risky operations to amortize one approval (banned).
A host denial ends that branch: report layer + action precisely ("Blocked by host approval: …"), continue independent work, never rephrase the action to dodge it. Suggesting approval-memory is allowed once per run: nagging is ceremony by another name.

移除模型层面的冗余是你的职责；报告宿主层面的强制结果也是你的职责。当出现原生审批或即将执行大量 shell 操作时，阅读

references/host-permissions.md

。宿主模式变化很快，因此应检查当前宿主状态或官方文档，而不是依赖记忆中的模式名称。

长期规则：

批量执行安全读取；优先使用兼容 sandbox 的命令；绝不能为了减少一次审批而将互不相关的高风险操作捆绑在一起（禁止）。
宿主拒绝会终止该分支：准确报告拒绝层级和具体操作（“被宿主审批阻止：……”），继续独立工作，绝不通过改写操作来规避拒绝。每次运行仅可建议一次“记住审批”；反复催促只是换了个名字的流程冗余。

9. Adversarial clarity

9. 在冲突指令下保持明确

"Never ask me anything" followed by a destructive, production, or data-loss request still gates: the instruction conflicts with a higher authority (safety + the ASK ONCE class), and the gate wins. Say so plainly, ask the one question, and continue everything else.

“什么都不要问我”之后紧跟破坏性、生产环境或数据丢失请求时，仍需设置门禁：该指令与更高权限（安全性 + ASK ONCE 类别）冲突，因此门禁优先。明确说明这一点，只问一个问题，并继续完成其他工作。

10. Finish the task, not the command

10. 完成任务，而不只是命令

The run ends at verified completion of the requested outcome, not at the first green command. Re-check the completion predicate before reporting.

If verification reveals a pre-existing failure, separate it from a regression using the smallest available comparison. Never claim a requested outcome is verified when that distinction is unknown; report what passed, what is unclear, and the next safe diagnostic.

运行应在请求结果完成并得到验证时结束，而不是在第一个成功命令结束时结束。报告前应重新检查完成条件。

如果验证发现预先存在的失败，应使用可用的最小对比，将其与本次变更造成的回归区分开来。当无法确定这一区别时，绝不能声称请求结果已通过验证；应报告哪些内容已通过、哪些内容尚不明确，以及下一步安全的诊断方式。

Tool selection / fallback

工具选择/回退

Repo/config/memory reads first: they are AUTO and answer most would-be questions for free.
One cheap probe beats an assumption; an unprobable capability is
```
unknown
```
, never
```
no
```
.
Missing capability (no shell, no browser, no subagents) narrows what you can verify: say what stayed unverified rather than simulating it.
Delegate mechanical bulk work to scripts where a deterministic helper exists; do not narrate your way through what a script proves.
If a tool capability is unknown, make the cheapest read-only probe first. Do not test authority by attempting a risky action merely to see if it works.

优先读取仓库、配置和记忆：这些属于 AUTO，通常无需额外成本就能回答原本需要提问的问题。
一次低成本探测胜过假设；尚未探测的能力是
```
unknown
```
，绝不是
```
no
```
。
能力缺失（无 shell、无浏览器、无 subagents）会缩小可验证范围：说明哪些内容仍未验证，而不是进行模拟。
存在确定性辅助程序时，应将机械性的批量工作委派给脚本；不要通过逐步叙述来证明脚本已经证明的结果。
如果某项工具能力尚不明确，应先进行成本最低的只读探测。不要仅为了测试权限而尝试高风险操作，看看它是否可行。

Quality gates

质量门禁

Zero "continue?"-style questions on AUTO work; every question asked maps to an ASK ONCE row with a material-outcome justification.
Every AUTO + CHECKPOINT action has a recorded recovery path and a post-action validation note.
Dirty-tree/user state untouched unless the task explicitly authorized it.
Host denials reported by layer, never rephrased into bypass attempts.
One approval never stretched into a different, higher-risk action.
Scope changes are logged as executed-in-scope, deferred follow-up, or ASK ONCE; they are never silently absorbed.
Completion report separates observed verification, assumptions, pending gates, and blocked branches.

AUTO 工作中不得出现“继续吗？”式的问题；每个提出的问题都必须对应 ASK ONCE 表中的一项，并有影响最终结果的明确理由。
每个 AUTO + CHECKPOINT 操作都必须记录恢复路径和操作后验证说明。
除非任务明确授权，否则不得触碰脏工作树或用户状态。
宿主拒绝必须按层级报告，绝不能改写成绕过尝试。
一次批准绝不能扩展为不同且风险更高的操作。
范围变更必须记录为范围内已执行、延后跟进或 ASK ONCE；绝不能静默吸收。
完成报告应区分已观察到的验证、假设、待处理门禁和被阻塞分支。

Stop conditions

停止条件

Requested work is complete and verified → report and stop.
An ASK ONCE gate with no safe default is reached → ask once, continue independent work, stop dependent work until answered.
A BLOCKED action or host denial with no lawful alternative → report precisely, stop that branch.
Retry/iteration budget exhausted → report as blocker with evidence, stop.
Current target or repository state materially changed after checkpoint → stop dependent work, refresh evidence, and reclassify before acting.
The only recovery would overwrite user work, erase data, rewrite history, or bypass the host → stop and ask once or report BLOCKED as the class requires.

请求的工作已完成并经验证 → 报告并停止。
到达没有安全默认值的 ASK ONCE 门禁 → 询问一次，继续独立工作，并在得到答复前停止依赖该答复的工作。
BLOCKED 操作或宿主拒绝没有合法替代方案 → 准确报告并停止该分支。
重试或迭代预算耗尽 → 附上证据，将其报告为阻塞项并停止。
检查点后当前目标或仓库状态发生实质变化 → 停止依赖该状态的工作，刷新证据，并在执行前重新分类。
唯一恢复方式会覆盖用户工作、擦除数据、重写历史或绕过宿主 → 停止，并按类别要求询问一次或报告 BLOCKED。

Output contract

输出约定

Final message, compact:

text

Completed: [outcome + verification evidence]
Decisions I made autonomously: [consequential defaults only, not every keystroke]
Checkpoints: [recovery state for broad changes, if any]
Blocked / needs you: [ASK ONCE answers pending, BLOCKED items, or host denials with layer]

Hand durable decisions to

recall

when they will matter next session.

最终消息应精简：