Run coding agents overnight from a task queue

Claude Code: claude -p

claude -p "<prompt>" runs Claude Code non-interactively: it works on the prompt, prints the result and exits. Nobody is there to answer a permission prompt, so decide permissions up front:

• --allowedTools lists tools that run without asking, in permission rule syntax: "Read,Edit", "Bash(git commit *)", or mcp__taskhold__* for every Taskhold tool.
• --permission-mode sets a baseline, for example acceptEdits (file edits and common filesystem commands) or auto (a classifier reviews each action). From v2.1.302, a -p run with no mode set starts in Manual mode, where a call that needs approval is denied.
• --permission-prompts none is meant for scheduled jobs: anything that would have fallen back to a prompt is denied instead of waiting.
• --max-budget-usd caps what one run can spend.

Leave out --bare for this. Bare mode skips MCP servers, CLAUDE.md and your subscription login (it needs ANTHROPIC_API_KEY), so the agent wouldn't see Taskhold unless you pass it with --mcp-config. Without --bare, claude -p loads your MCP servers and CLAUDE.md the way an interactive session does.

Codex: codex exec

codex exec "<prompt>" is Codex's non-interactive mode. Settings from its docs that matter for an unattended run:

• codex exec runs in a read-only sandbox by default. Add --sandbox workspace-write to let it edit the repo. OpenAI says to use danger-full-access only in an isolated runner or container.
• --full-auto is no longer supported; use --sandbox workspace-write.
• Codex expects a Git repository and refuses to run outside one unless you pass --skip-git-repo-check.
• Set required = true on the taskhold entry in config.toml, and codex exec exits with an error when the server fails to start, instead of working without the queue.
• In a non-interactive run, an action that needs a fresh approval fails rather than waiting. In its default mode Codex asks before taskhold_plan and taskhold_update, so check the server's approval settings (default_tools_approval_mode, or approval_mode per tool) with a short test run before leaving it overnight.

Starting the run

Something on your machine has to start the agent: a shell loop you run before bed, a cron entry or a launchd job. The machine has to stay awake; on a Mac, caffeinate -i ./overnight.sh keeps it from idle sleep while the script runs.

Claude Code has its own schedulers too. /loop tasks are tied to the session: they fire only while Claude Code is running and idle, and recurring ones expire after 7 days. Desktop scheduled tasks run on your machine without an open session, and cloud routines run on Anthropic's infrastructure against a fresh clone, so they don't see local files. Any of them can work from the same Taskhold queue, since the agent only needs the MCP server.

A loop that works through the queue

The script below runs one claude -p per task until the queue is empty or five runs have gone by. Each run asks Taskhold for the next todo in one project, claims it, works on a branch, reports steps and either completes the task or blocks it with a question. A blocked task leaves the todo list, so the next run moves on to the next task.

#!/usr/bin/env bash
# overnight.sh: work through the Taskhold queue for one repo, one task per claude -p run.
# Taskhold doesn't start this script. Run it yourself, or from cron or launchd.
set -u
cd "$HOME/code/my-repo" || exit 1
PROJECT="my-repo"
PROMPT="Call taskhold_list with project \"$PROJECT\" and status todo. If there are no tasks, reply with exactly QUEUE_EMPTY and stop.
Otherwise take the first task with taskhold_begin (task_id, a short list of steps, agent \"Claude Code overnight in $PROJECT\").
Work on a new git branch named after the task and commit there. Never push, merge or deploy.
Finish each step with taskhold_complete and start_next true. If you need a decision from me, call taskhold_block with one specific question and stop.
When the task is done, call taskhold_complete on it with a summary of what changed and how you checked it."

for run in 1 2 3 4 5; do
  out=$(claude -p "$PROMPT" \
    --permission-mode acceptEdits \
    --allowedTools "mcp__taskhold__*,Bash(git switch *),Bash(git add *),Bash(git commit *),Bash(bun test *)" \
    --permission-prompts none \
    --max-budget-usd 5)
  printf '%s run %s\n%s\n\n' "$(date)" "$run" "$out" >> overnight.log
  case "$out" in *QUEUE_EMPTY*) break ;; esac
done

For Codex, replace the claude -p call with codex exec --sandbox workspace-write "$PROMPT". To start it at 1 a.m. every night, a crontab line such as 0 1 * * * $HOME/bin/overnight.sh does it, as long as the machine is awake then.

Taskhold as the queue

• During the day, file tasks into the repo's project with a priority, from the web app or by asking an agent. taskhold_list returns in-progress tasks first, then blocked, then todo by priority; with status todo it returns only the queue.
• taskhold_begin claims a task, saves its steps and starts the first one, so the board shows which agent took it and when.
• Progress reports (taskhold_complete with start_next, taskhold_progress for long steps) fill in the bar step by step. If an agent goes silent, its status dot turns Quiet and then No word.
• taskhold_block parks a question on the task instead of guessing. It waits under Needs you at the top of the board until you reply.

Agents need instructions to use the list this way. The block in the quickstart covers it; the loop's prompt above repeats the parts that matter for an unattended run.

In the morning

Open the live board. Finished tasks carry the agent's summary and the branch it used; blocked tasks show the question at the top. Reply, or press Reply & unblock to put the task back in the queue, and the next run reads your answer with taskhold_updates before it continues. Then review the branches as you would any pull request; review what your agent did covers reading the history.

Keep unattended runs safe

• Work on a branch or a git worktree, never on main, and leave push, merge and deploy commands out of the allowed tools.
• Allow only the commands the tasks need. With --permission-prompts none, anything else is denied, and the stream-json output lists the denials so you can see what was blocked.
• Cap spend per run with --max-budget-usd, and cap the number of runs in the loop.
• Queue tasks that are small and well specified. A task that needs judgment calls tends to end the night blocked on a question rather than done.