Bypass mode (owner opt-in, default off): storebound settings bypass on|off|status and a one-time question in init; MCP owner_step (owner-only commands, dry run first), owner-only api operations with --yes --confirm, console plans may press buttons.final; every action logged to .storebound/owner-actions.log; docs/bypass.md, agent rules, tests

cli/lib/desktop-coverage.ts

@@ -46,6 +46,7 @@ export const DESKTOP_COVERAGE: Record<string, Coverage> = {
   'import': { where: 'App folders / first-run guide: Import from fastlane', methods: ['host:project_import_fastlane'] },
   'install': { where: `${T}: Install for an AI tool`, methods: ['agent.install'] },
   'mcp': { not: 'the stdio server for AI tools; the window itself is the GUI over the same commands' },
+  'settings': { not: 'per-machine switch for AI agents (bypass mode); in the window the owner presses owner actions in a native dialog anyway' },
   'serve': { not: 'the JSON-RPC sidecar the window runs on; nothing to click' },
   'apps': { where: 'Accounts (store apps per account, key check) and App folders (list, add, remove)', methods: ['host:store_apps_refresh', 'host:account_check', 'host:projects_list', 'host:project_add', 'host:project_remove'] },
   'desktop': { not: 'opens or installs this window from a terminal' },