Autopilot自動駕駛

Hand over the whole job: orchestrate subagents, self-repair on a budget, pass a verification gate, then commit, push and open a PR without checking back整份工作交出去:以 subagent 為主力執行、故障自修有次數上限、過驗證閘門後 commit、push、開 PR,全程不回頭問

EN繁中User-invoked使用者叫用
Read SKILL.md on GitHub在 GitHub 看 SKILL.md

Most "just run it" instructions fail in the same two ways: the agent stops to ask something halfway through, or it runs out of context because it read every file itself. Autopilot is written against both. It treats the run as one handover — plan internally, delegate the reading and the scoped edits, self-repair on a fixed budget, pass a verification gate you can audit, then commit, push and open a PR — and batches every decision it made into a single report at the end.

Install

npx skills add https://github.com/leoluyi/skills -g -a autopilot -y

To update later:

npx skills update autopilot

Source

What it does

Seven steps, in order: scope the job, decide isolation, spawn a recon agent to map the code it touches, write the full task breakdown with each item's file scope, build the list top to bottom, review and verify, then ship.

Delegation is the default, not the exception. Recon, scoped implementation, fixing a broken build, irreversible decisions and pre-ship review all go to subagents; task breakdown, cross-cutting edits, integration, the verification gate and every git operation stay in the main loop. Todos with disjoint file scopes go out concurrently; overlapping ones run one at a time. If a todo's file scope can't be stated, it isn't decomposed enough to delegate.

For the duration of the run it suspends the standing "discuss the approach first / ask about preferences / stop and confirm before committing" rules — that's the point of invoking it — while everything else in your CLAUDE.md still binds: no placeholder comments, no partial work reported as finished, no emojis, no hardcoded secrets.

When to use

When the approach is already settled and you want the job finished end to end without being interrupted. Hand it a plan, answer one pre-flight question, walk away, read one report.

When not to

Not while the approach is still open, not for exploratory work, and not when you want to see each step before it lands. It commits and pushes without asking, which is why it never fires on its own — you have to invoke it by name.

How it works

Three mechanisms carry most of the weight.

The three-attempt bound. Each distinct blocker gets three fix attempts, and each attempt must rest on a different hypothesis. The count is per blocker, not per agent, so a subagent that already burned two leaves one. Re-running the same fix with cosmetic variation isn't an attempt, it's a loop, and gets cut. Nothing may route around a blocker by weakening the check that caught it — no deleting a failing test, loosening a type, or widening an exception handler — and that prohibition goes into every subagent brief, because an agent under pressure to return green will reach for exactly that.

The verification gate. Before any commit: parallel review agents over the full diff (plus a security pass whenever the change touches input handling, auth, credentials, network calls or persisted data), and the repo's own checks, discovered rather than assumed and run in the main loop. A subagent's report that a failure is fixed is not the gate — the green output has to be seen directly, because a hard stop nobody can audit isn't a hard stop.

The isolation ladder. Six rules, checked in order at step 2, before anything else touches the repo. Five of them are already forced — four off git state alone (already on a non-default branch, already inside a worktree, a dirty tree, work that builds on pushed-but-unmerged commits), plus the case where you told it the run is solo. Those exceptions exist because a worktree carries no uncommitted changes across and branches from the remote default, so each of them branches in place instead.

The sixth rung — clean tree, on the default branch — is the only one where both paths are legal, and there it asks rather than picks: worktree or branch in place, with the worktree recommended because the risk is asymmetric. Two sessions checked out in one directory silently overwrite one HEAD and one index, undetectable from either side, while an unnecessary worktree costs one dependency install. The question lands at invocation, while you are still there to answer it, so the autonomous stretch that follows really is uninterrupted; state a preference when you invoke and it skips the question, and a scheduled or headless run with nobody to ask falls back to the worktree and says so in the report.

Four hard stops are the only reasons it breaks the no-interruption rule: a blocker surviving three distinct attempts, a verification gate that stays red, a destructive or irreversible operation, or a security problem. On any of those it stops, leaves the tree coherent, and reports — no push, no PR.

Related skills

plan-to-goal and goal-definer produce the bounded target this skill executes against; running Autopilot on a vague objective is how an unbounded run happens. breakdown and options are its opposites — reach for those when the direction is still open and you want the decisions surfaced rather than batched.

大多數「你就直接跑」的指示都敗在同樣兩件事:agent 做到一半停下來問你,或是因為每個檔案都自己讀而把 context 燒光。Autopilot 就是針對這兩點寫的。它把這一輪當成一次性的交接——內部規劃、把讀檔和有界的修改交給 subagent、故障自修有固定次數上限、通過一道你能稽核的驗證閘門,然後 commit、push、開 PR——最後把過程中做的每個決策集中成一份報告交回來。

安裝

npx skills add https://github.com/leoluyi/skills -g -a autopilot -y

之後更新:

npx skills update autopilot

原始碼

它做什麼

七個步驟,依序執行:界定工作範圍、決定隔離方式、派一個 recon agent 把牽涉到的程式碼摸清楚、寫出完整的任務拆解且每一項都帶檔案範圍、由上而下把清單做完、審查與驗證、出貨。

委派是預設,不是例外。recon、有界的實作、修壞掉的 build、不可逆的決策、出貨前的審查全部交給 subagent;任務拆解、跨檔案的修改、整合、驗證閘門,以及每一個 git 操作都留在主迴圈。檔案範圍不重疊的待辦同時派出去,重疊的一次一個。如果某項待辦講不出檔案範圍,就代表它還沒拆到可以委派的程度。

執行期間它會暫停「先討論作法/先問偏好/commit 前先確認」這些常設規則——這正是呼叫它的意義——但你 CLAUDE.md 裡的其他規範照樣有效:不留佔位註解、不把半成品當完成回報、不用 emoji、不寫死機密。

何時使用

作法已經定案、你要它從頭做到尾且中途不被打斷的時候。把計畫交給它,回答一個起飛前的提問,人走開,回來讀一份報告。

何時不要

作法還沒定、探索性的工作、或你想逐步確認再落地時都不要用。它不問就 commit 和 push——正因如此它不會自己觸發,一定要你指名呼叫。

運作方式

三個機制撐起大部分的重量。

三次修復上限。 每個不同的卡點有三次修復機會,而且每一次都必須換一個假設。次數是算在卡點上而不是 agent 上,所以一個已經燒掉兩次的 subagent 只留給你一次。同一個修法換個外觀再跑一次不算一次嘗試,那叫迴圈,會被當場切掉。任何情況都不准靠削弱抓到問題的檢查來繞過去——不刪失敗的測試、不放寬型別、不擴大例外處理——而且這條禁令會寫進每一份 subagent 的任務說明,因為被逼著要交出綠燈的 agent 第一個想到的就是這招。

驗證閘門。 commit 之前:平行的 review agent 掃過完整 diff(只要改動碰到輸入處理、認證、憑證、網路呼叫或持久化資料,就額外加一輪 security),加上 repo 自己的檢查——要主動找出來而不是憑空假設,而且在主迴圈裡跑。subagent 回報「已修好」不算通過閘門,必須親眼看到綠燈輸出,因為沒人能稽核的硬性停止就不是硬性停止。

隔離階梯。 六條規則依序判斷,在第 2 步、任何東西動到 repo 之前就跑完。其中五條的答案早已被決定——四條直接從 git 狀態讀出來(已經在非預設分支上、已經在某個 worktree 裡、工作目錄是髒的、工作建立在已 push 但未合併的 commit 上),再加上你已經講明這一輪是單人作業的情況。這些例外之所以存在,是因為 worktree 不會把未提交的改動帶過去,而且是從遠端預設分支切出來的,所以它們一律改成原地開分支。

第六條——工作目錄乾淨、人在預設分支上——是唯一兩條路都合法的一格,它在這裡選擇提問而不是自己挑:worktree 還是原地開分支,並且建議 worktree,因為風險不對稱。兩個 session 檢出在同一個目錄,不會產生 merge conflict,而是一個 HEAD 和一個 index 被無聲覆蓋,兩邊都察覺不到;反之,一個結果證明不必要的 worktree 只多花一次安裝相依套件的成本。這個提問落在呼叫的當下、你人還在的時候,所以接下來那一段自主執行才真的是不被打斷的;你在呼叫時就講明偏好它就不問,而排程或無人介面的執行找不到人可問時,退回 worktree 並在報告裡寫明。

只有四種硬性停止可以打破不打擾原則:一個卡點撐過三次不同的嘗試、驗證閘門持續紅燈、任務需要破壞性或不可逆的操作、發現安全問題。碰到任何一種它就停下、讓工作目錄維持一致狀態、回報——不 push,不開 PR。

相關技能

plan-to-goalgoal-definer 產出的正是這個技能要對著執行的有界目標;拿一個模糊目標去跑 Autopilot,就是無界執行的由來。breakdownoptions 則是它的反面——方向還沒定、你想讓決策一個個浮上來而不是集中回報時,用那兩個。