Approve AI Actions From Your Phone With Safeguard, Step by Step

To approve AI actions from your phone, keep the Safeguard CLI running on your computer, open the Safeguard app, choose "Work on my computer", and pick the computer and folder. Each command the assistant wants to run then waits on your phone for Allow once, Allow for turn or Deny. Nothing runs on the computer until you answer.

You can do this without giving up the AI plan you already have. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. If you prefer a chat app, you can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from there.

This guide walks through the whole loop on a real project: setting up the computer, sending work from the phone, reading each request before you tap, finishing on the desktop when the diff is too long for a small screen, and undoing a change you regret. The commands come from the help pages in CLI v11.11.0 and the Safeguard docs listed at the end.

What you will have at the end

By the end of this guide you will have:

1. A computer that stays reachable from your phone while it is on, through safeguard runner install, with only outbound HTTPS and no open port.
2. The Safeguard app on your phone, signed in to the same account, showing the same conversations as your terminal and desktop.
3. A tested habit for approvals: what to read before you tap Allow once, when Allow for turn makes sense, and when Deny is the right answer.
4. A way back. You will know how to list and restore the checkpoints the assistant took before each file change.

After the first setup, the phone part of a fix is a few taps.

How phone approvals work

Four pieces make this work, and it helps to know which piece does what.

The CLI on your computer does the work. The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. Files are read and edited there, and commands run there. Your phone never runs code.

A CLI session is live. It shows in the web app, the desktop app and the phone app, and other devices can send work to it. That is why a conversation you start in a terminal appears in the app's list.

The runner carries the work. The runner polls the platform for turns meant for it and relays every step back. The help text for runner install puts it plainly: "Nothing listens on a port: the runner only opens outbound HTTPS." Your computer does not need to be reachable from the internet.

The phone answers the questions. When the assistant wants to run a command or change a file, the request waits for a person. Safeguard's download page says it this way: "Sensitive steps wait for a person, and every action is logged and reversible."

The three answers on the phone

On the desktop app the same request shows as Approve or Deny. In the terminal you press y or n.

Do the work properly with the Safeguard CLI

Your phone can only approve what a computer is ready to do, so the CLI comes first. It writes code, not only scans it.

Install

On macOS and Linux:

curl -fsSL https://cli.safeguard.sh/install | bash

On Windows, in PowerShell:

irm https://cli.safeguard.sh/install.ps1 | iex

It is a single static binary with no Node, Python or JVM to install. It runs on macOS, Linux and Windows, on x86_64 or arm64 (Windows is x86_64 only), and the installer verifies the release checksums. There are platform guides for macOS and the other systems.

First session

cd ~/projects/payments-api
safeguard --version
safeguard

With no arguments, safeguard opens the interactive terminal. Type /login and approve the session in your browser. Type /scan . to scan the current folder, or ask in plain language, for example "how many critical vulns do we have". The first run downloads the scanner tools, so let it finish at your desk before you rely on the computer from your phone. Type @ to attach a file from the folder you started in, and /resume picks up the last session in that folder the next time you open the terminal there.

Writing and fixing code

The assistant has tools for your local files and for your Safeguard data and picks whichever the question needs. Ask "fix the lodash CVE in this repo" and it can edit code and run commands, with your approval. You can use it as a general terminal assistant too: find and read files, edit code, run commands, plus everything security. The phone flow in this guide is the same assistant, with the approval prompt moved to your pocket.

Your Claude, ChatGPT or Codex plan

As covered at the top, the plan you already pay for works inside the CLI with no extra charge from Safeguard, under your plan's own limits and terms. /model shows or switches the model; the CLI docs cover connecting one.

Approvals on the computer

/permissions decides which actions reach your phone at all. The modes are:

• Ask: reads run; edits and commands ask first.
• Accept edits: edits in this folder and read-only commands run; other commands ask.
• Plan: read and plan only.
• Auto: read-only commands and what the policy allows run; anything else asks. This is the default.
• Strict: pre-approved actions only, for CI.

For remote work from a phone, Ask or Auto are the sensible choices. Ask sends you every edit and command. Auto lets reads and policy-allowed actions through and sends you the rest. There is also a --yolo flag that approves everything. It belongs in a throwaway sandbox only, and never on a computer you control from your phone, because then there is nothing left to approve.

CI with safeguard exec

For unattended jobs, safeguard exec "summarise the critical findings in this repository" runs one non-interactive turn. Its default mode is strict, so it asks nobody and denies anything not pre-approved. Phone approvals are for work you supervise; exec is for checks that need no supervision. Our security aware coding assistant guide covers the interactive side in more depth.

Walkthrough: set up your computer

Do this once, at your desk.

1. Install and sign in. Run the install command above, then safeguard and /login. On a machine without a browser, safeguard login --no-browser prints a URL and a code to enter on another device, such as your phone.

2. Check the install.

   safeguard whoami
   safeguard doctor
   

   whoami shows the account and token expiry. doctor checks environment, sign-in, tools and policy and changes nothing.

3. Keep the computer reachable. In the folder you want to work in:

   cd ~/projects/payments-api
   safeguard runner install
   

   This registers safeguard runner start as a per-user login service so your phone or browser can send turns to this machine from any network while it is on. It uses a systemd user unit on Linux, a LaunchAgent on macOS and a logon scheduled task on Windows. --workspace sets the folder the runner works in, and the current folder is the default. --permission-mode accepts supervised, edits, plan, guarded, strict or autonomous if you want the runner to use a mode other than its own default. Whatever you choose, keep autonomous off a computer you control from your phone.

4. Confirm it is running.

   safeguard runner status
   

   --json prints the running process, runner identity and service installation as JSON.

5. Install the app on your phone. Android phones and tablets install from Google Play. iPhone and iPad install from the App Store; the listing asks for iOS or iPadOS 16.4 or later and a Safeguard account. The download page also offers a direct Android APK for phones without Google Play or for company managed rollout; check its SHA-256 before you install it. Sign in with the same account you used on the computer.

6. Check the two can see each other.

   safeguard devices
   

   This lists your signed-in devices that can send and receive. Your phone should appear.

If you would rather not install a login service, run safeguard runner start --workspace ~/projects/payments-api in a terminal you leave open, and safeguard runner stop when you are done. The local runner docs cover the headless commands.

Walkthrough: send work from your phone and approve it

Now the part you will repeat. This example uses the payments-api sample from the recordings and the same lodash upgrade as the CLI demo.

1. Open the Safeguard app. Conversations you started in the terminal or the desktop app appear here too.

2. Choose "Work on my computer". Pick the computer running the CLI, then the folder. If the computer is missing, see the troubleshooting section.

3. Ask for the work in one sentence. "Fix the lodash CVE in this repo and run the tests" is a good size. One task, one folder, a clear finish line.

4. Let it read. Reading files, findings and advisories does not need your approval in Ask or Auto mode, so the first steps happen without a prompt.

5. Answer the first request. The command waits on the phone. Read the whole command, check the folder, then tap Allow once, Allow for turn or Deny.

6. Follow the edits. A change to package.json that bumps lodash to 4.17.21 is short enough to read on a phone. A long multi-file diff is not; see the desktop section below.

7. Approve the checks. npm install and npm test each ask in turn. Tests are the step you most want to see run.

8. Read the answer. The final message shows whether the tests passed. Nothing is pushed unless you ask for it and approve it.

This recorded Android session shows those steps: the same conversations on the phone, "Work on my computer" picking a computer running the CLI and a folder, the command waiting for Allow once, Allow for turn or Deny, and an answer showing the tests passed.

Click through it at your own pace, or open it full screen.

For installing and using the Android app more generally, see Safeguard on Android phones and tablets.

Read the request before you tap

A phone makes approving easy. That is the risk. A short checklist keeps it honest.

Is this the folder I picked? The request should be inside the workspace you chose. A path in your home folder, /etc or another project is a reason to deny.

Can I read the whole command? If it scrolls past the screen, deny it and finish at a keyboard.

Is it the command I expected for this task? npm install after a manifest edit is expected. A download piped into a shell is not.

Does it reach the network? Package installs do. A curl to an address you do not recognise does not belong in a dependency fix.

Does it delete anything? rm, git reset --hard and git clean deserve a desk, not a lock screen.

Would I run it myself? If the answer is no, the answer on the phone is Deny.

Use Allow for turn sparingly. It suits a run of similar, low risk steps in a task you already understand. It is a poor fit for the first command of a task, or for anything that writes outside the project.

Denying is not a failure. The action simply does not run. You can tell the assistant what to do instead, or pick the task up later at your desk.

Finish on the desktop when the diff is long

Some changes are too big to judge on a phone: a major version upgrade, edits across many files, or a lockfile change you want to read line by line. Move to the desktop app. The same conversation is already there.

This recorded desktop session shows the CLI session in the desktop app's conversation list, "2 connected" for the computer, the browser and Safeguard cloud, and a request for work on your computer. The app asks which computer and folder, you pick the folder, then you Approve or Deny each command and file edit. It ends with the upgrade done and tests passing.

Click through it at your own pace, or open it full screen.

The desktop app (3.2.2 on the download page) runs on Windows 10 and 11, macOS 12 and later, and Linux as an AppImage, which needs the Safeguard CLI on your PATH. Our desktop app guide covers installation. Before you merge anything from a phone-approved session, review it the way you would any AI generated change; reviewing AI generated code before merge has a checklist.

Undo a change with checkpoints

You approved an edit and now regret it. The CLI snapshots files before the assistant writes or edits them, and you can go back.

1. List the checkpoints for the session.

   safeguard checkpoints list --session <session-id>
   

   They are listed oldest first.

2. Preview the restore.

   safeguard checkpoints restore <checkpoint> --session <session-id> --dry-run
   

   --dry-run changes nothing and prints a diff per file.

3. Restore.

   safeguard checkpoints restore <checkpoint> --session <session-id> --files-only
   

   A restore puts every file changed since the checkpoint back as it was and removes files the agent created. --files-only keeps the conversation as it is; without it the transcript rolls back too, as /rewind does in the terminal. The state you overwrite is kept as a new checkpoint, so a restore can itself be undone.

One limit matters here: files the agent writes or edits are snapshotted, but "anything a shell command writes is not." If you approved npm install, the changes to node_modules and the lockfile came from a command. Git is your undo for those, which is one more reason to work in a clean branch.

Troubleshooting

For anything else, safeguard doctor prints what is wrong in the order that matters, and logs are in ~/.sg/logs/safeguard.log.

Common mistakes

Running the computer in --yolo. Then nothing waits for you, and the phone has nothing to approve. Use Ask or Auto.

Approving a command you could not read in full. Deny it, and finish at a keyboard.

Using Allow for turn on the first step. Start with Allow once until the task has shown you what it is doing.

Working on the main branch. Create a branch before you send work from the phone, so a bad change is one git checkout away.

Assuming checkpoints cover command output. They cover files the agent edits, not what a shell command writes.

Letting the computer sleep. The runner needs the computer on. A laptop with its lid closed will not pick up your turn.

Forgetting the token expires. If phone requests stop reaching the computer after a while, safeguard whoami is the first check.

FAQ

Can I keep my Claude, ChatGPT or Codex plan?

Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. See /model or the CLI docs for connecting a model. You can also connect Claude or ChatGPT to the Safeguard MCP server.

Does my code go to my phone?

No. The work runs on the computer. The runner relays steps back to the platform over outbound HTTPS, and the phone shows the conversation and the requests. When the runner runs platform scan jobs, only SBOMs and findings are uploaded, never source.

Does my computer need an open port?

No. The runner only opens outbound HTTPS connections. Nothing connects to it.

Which phones are supported?

Android phones and tablets from Google Play, plus a direct APK for phones without Google Play. iPhone and iPad from the App Store. The recorded session in this guide is on Android.

What is the difference between Allow once and Allow for turn?

Allow once runs the one action in front of you. Allow for turn covers the rest of the current turn. When in doubt, use Allow once.

Can I approve from the desktop app instead?

Yes. The desktop app shows the same conversations and asks you to Approve or Deny each command and file edit. Many people approve short steps on the phone and finish long diffs on the desktop.

What if I deny something by mistake?

Ask again in the conversation. A denied action did not run, so nothing needs undoing.

Can a phone approval push code to my repository?

Only if the assistant asks to run a push and you approve it. In the recorded sessions, the assistant prints a summary and a suggested commit message and pushes nothing.

Try it yourself

Start with the computer side. This walkthrough sets up the runner, picks the platform, starts it, approves it with its device code, then uses the same CLI to scan from the terminal.

Click through it at your own pace, or open it full screen.

Then download the Safeguard CLI and the mobile app, run safeguard runner install in one project, and send your first small task from your phone. The full reference is in the CLI docs.

Quick check

Sources

• Safeguard CLI overview
• Safeguard CLI interactive terminal
• Safeguard CLI slash commands
• Safeguard CLI usage guide
• Safeguard CLI troubleshooting
• Safeguard local runner
• Safeguard downloads
• Safeguard.sh on the App Store

Last reviewed: 21 October 2026.