Auto-Nudge: Stop Claude Code Asking 'Should I Continue?'

You set Claude Code on a multi-step refactor, walk away for a coffee, and come back to find it parked on step two, waiting for permission to run mkdir. The agent did not crash. It did not run out of context. It stopped to ask "should I continue?" and is now politely waiting for your acknowledgment. Here is what is actually firing those prompts, why they cluster on the work you most want to leave running, and what an auto-nudge layer changes about the round trip.

The permission model that produces the prompt

Claude Code's permission system is opt-in by default. Anything that touches the file system, executes a shell command, or hits a network endpoint requires explicit allow-list entry before the agent runs it without asking. Anthropic's published model lists three buckets: tools that are always allowed (the agent decides), tools that require approval per use (the user decides), and tools that are blocked entirely.

The "should I continue?" prompt is the user-decides bucket firing on a command the agent has not been told it can run. The default ruleset is conservative: bare Bash requires approval per invocation. So does Write on any path that has not been pre-cleared. So does any MCP tool that has not been added to the allow-list. That conservatism is the right default for a fresh install — it stops the agent from chmod-ing your home directory on its first day. It also means a multi-step task with twenty shell calls produces twenty interruptions.

What developers see on screen looks like the agent losing nerve. What is actually happening is the permission gate doing its job. The agent does have a plan; the gate is asking whether each step in the plan should be allowed to execute.

Why the prompts cluster on the worst possible moments

If the gate fired uniformly across the task, the interruptions would be tolerable. They do not fire uniformly. They cluster.

A few patterns produce the clustering:

1. Tool variation. A refactor that touches twelve files uses Edit twelve times — twelve approvals, one per file path that has not been allow-listed. The agent reaches a sub-task that needs Bash to run a test, and that is a new approval surface. Then it wants to Write a new config, and that is another. The permission gate's question of "should I continue?" is fired per tool surface per argument shape, not per "task."
2. Argument generalization is weak. Claude Code's allow-list can match exact commands ("Bash(git status)") but does not gracefully generalize variants ("Bash(git status --porcelain)"). A near-identical command at a slightly different argument is a fresh approval gate. Real refactor work generates a long tail of these variants.
3. Stop hooks. Anthropic exposes Stop hooks that can intercept end-of-turn behavior. Some users have wired hooks that intentionally cause the agent to halt at logical checkpoints. Combined with the permission gate, the cumulative effect is a session that stops far more often than the user expected.
4. Auto-compact boundaries. When the conversation approaches the context cap, Claude Code's auto-compact fires. The agent summarizes earlier turns, then resumes — and the resume often emits a fresh "ready to continue?" cue, because the post-compact replan is a new planning surface. Two compact events in one session, two extra confirmation rounds.

The result is a session that runs unattended for fifteen minutes, then sits idle for forty waiting for a human eye to come back.

What developers reach for first

The community has converged on a small set of workarounds, in order of escalation.

Pre-approve everything in settings.local.json. The official move. Add tool names and argument patterns to the project's permissions.allow list. This works for stable commands but does not survive new argument shapes, and the file gets long fast. Maintenance cost is real: a six-month-old project accumulates approvals for tools no one runs anymore.

Use the --dangerously-skip-permissions flag. Anthropic's nuclear option. Launches Claude Code with the permission gate disabled entirely. Works. Also occasionally produces the horror stories that fuel issue threads where Claude deleted the user's Desktop folder because nothing was there to stop it. The flag's name is honest about its risk: a single bad command, run unattended, can shred a working tree.

A representative thread on the trade-off:

Claude Code's default behaviour is to ask for permission for every command it wants to run. This makes sense from a security perspective, but it becomes a major workflow killer when you're trying to automate longer tasks.

That is from ksred's analysis of the skip-permissions flag. The same piece documents the failure mode: a developer setting Claude Code on a config-update task, walking away, returning to find Claude had wiped the live config file by writing blank defaults to it because no backup step existed and no gate stopped the destructive write.

Babysit the session. A real choice, and the worst one in aggregate. Engineer time spent watching for "should I continue?" prompts is the most expensive line item in the whole stack. A senior developer at $150/hour, idle for an hour waiting on prompts, has spent more on the babysitting than a month of Claude Max.

Write a watchdog script. A growing pattern: a small process outside the editor that watches the Claude Code transcript JSONL file for the "should I continue?" pattern and auto-injects a "yes" response. Community gists exist. They are fragile. The transcript format has changed twice in six months. Each rewrite of the gist breaks two weeks later.

What an auto-nudge layer actually does

The fragile-gist approach has the right shape but the wrong substrate. The shape: detect when the agent is parked, decide whether the parking is safe to skip past, inject the resume signal. The wrong substrate: parsing a private transcript format that changes on every Claude Code release.

A workable auto-nudge layer attaches to the request stream, not the editor file. It sees the API exchange between Claude Code and Anthropic's endpoint, recognizes the response patterns that produce a parking event, and acts on them. The recognition logic is more durable because the API response shape is what Anthropic ships to all clients, not just the editor.

The decision of whether to nudge is policy-driven, not blanket. A working layer respects:

• Tool-class safety. Read tools (Read, Grep, Glob, network GETs) get nudged automatically. They have no side effects worth pausing for. Write/Edit/Bash get a configurable policy that the user sets per project.
• Destructive command detection. Bash invocations that match dangerous shapes (rm -rf, git reset --hard, curl | sh, anything piping unverified network input to a shell) never nudge — they sit on the gate until a human approves.
• Session boundaries. A new session starts with stricter defaults. After ten minutes of consistent allow-pattern behavior, the nudge layer can relax its checks based on observed safety.
• Audit log. Every auto-nudge writes a line to a local audit file. Reviewable. Reversible. The user can grep "what did the nudge layer allow yesterday?" and read the actual decisions, not infer them from a half-remembered conversation.

The result is a session that runs unattended for hours on read-heavy work without losing the safety story on write-heavy work. The agent stops asking about git status and ls and cat. It still stops on rm -rf node_modules. The senior-developer time spent on per-step approvals collapses to zero on the long tail of safe commands, and stays at one hundred percent attention on the few commands that deserve it. The watchdog that does this is free to download and try, no credit card needed — you can point it at a live session and watch the safe long tail stop interrupting you.

The cost the layer recovers

The babysitting bill is concrete. A multi-step refactor that takes the agent forty minutes of compute spans two and a half hours of human time when twenty permission prompts arrive at five-minute intervals. The agent is idle for the same forty minutes plus the cumulative wait between human responses. At a senior developer's loaded cost, the recovered time per task pays for the layer within a week of normal use.

There is a second-order recovery worth naming. The "should I continue?" prompt arriving every five minutes also kills the cognitive flow the developer needs to do other work in parallel. A developer waiting for Claude Code prompts cannot fully context-switch to writing a design doc or reviewing another PR, because the prompt could land at any moment and the cost of missing it for thirty minutes is starting the agent's planning state from scratch.

An auto-nudge layer plus a real notification (push to phone, desktop alert, Slack) restores the asymmetry: agent runs unattended, user gets paged only when something deserves human judgment. The default is "agent makes progress." The exception is "agent waits."

Frequently asked questions

Why does Claude Code ask "should I continue?" between obviously related steps?

Because the permission gate does not know they are related. From the gate's perspective, each tool invocation is independent: a fresh Bash command, a fresh Edit on a path it has not seen, a fresh Write to a directory not yet in the allow-list. The agent's task plan is one thing; the gate sees each tool call as another. The "should I continue?" prompt is the gate doing per-call accounting, not the agent losing track of the task.

Is --dangerously-skip-permissions safe to use?

It depends entirely on what the agent might do with the freedom. For sandboxed work — a throwaway container, a known-good repo with version control, no production credentials — the risk is low and the productivity gain is high. For work touching real production data, real credentials, or the user's actual home directory, the flag is genuinely dangerous. The GH #30700 thread where Claude deleted the user's Desktop directory is the canonical cautionary tale. Use the flag where the blast radius is contained; never where it is not.

How does an auto-nudge layer differ from --dangerously-skip-permissions?

The skip-permissions flag disables the gate entirely. Every command runs without check. An auto-nudge layer leaves the gate intact for dangerous commands and skips only the safe long tail (Read, Grep, well-formed Bash on whitelisted paths). The blast radius of a misfire is bounded by the same allow-list logic the gate already uses, plus a destructive-shape detector layered on top.

Will an auto-nudge layer cause Claude Code to ignore my explicit deny rules?

A working implementation honors the project's existing permissions.deny list as the floor. The layer only acts on commands that would have been allowed if the user had answered "yes" at the prompt. Denied commands stay denied. Ambiguous commands stay paused until the user answers.

Can I see what the nudge layer decided while I was away?

A working implementation writes an audit log per session. Each nudged command shows the tool, the arguments, the timestamp, and the rule that allowed it. The expectation is that the developer can grep the log when they return and verify nothing surprising happened. Sessions where the audit shows a command the developer did not expect should reduce the auto-allow scope on the next run.

Related reading

• Claude Code Auto-Compact: Why the Summary Loses Your Work — the second-most-common reason a session pauses to ask for direction is that the prior turns just got summarized away.
• Paying Opus, Served Haiku: Silent Downgrades in Claude Code — if the agent is also asking questions it should not need to ask, the model on the other end may be smaller than the dashboard says.
• The $6,000 Overnight Claude Code Loop: How Bills Snowball — what happens when "just keep going" runs unattended without the safety story this article describes.

What developers are reporting

Developers have asked Anthropic for this directly. GitHub issue #18980 requests a "Continue after limit is reset" option because "setting a timer and waiting to type continue is not very efficient" — especially across several open sessions. Auto-resume is that feature, today.

Closing

The permission gate exists for a reason — the GH #30700 thread is what happens when nothing checks the agent's hand on the wheel. The default settings exist for the same reason. The cost of those defaults, paid in senior-developer attention, is large enough to fund a layer that pulls "should I continue?" prompts out of the read-heavy long tail without softening the safety story on the write-heavy short list. The watchdog we ship is the version we built for our own sessions, and the version we put in front of customers running Claude Code unattended.

If you want to run it against a long unattended session of your own, the 14-day Premium Trial is $0 today and you can cancel anytime before day 15 — it adds the watchdog, the audit log, and push notifications on top of the nudge layer. Not ready to put a card down? Install Power Claude Free instead: the 7-day free trial gives you full Pro access, no credit card.