Bypass mode (owner opt-in, default off): storebound settings bypass on|off|status and a one-time question in init; MCP owner_step (owner-only commands, dry run first), owner-only api operations with --yes --confirm, console plans may press buttons.final; every action logged to .storebound/owner-actions.log; docs/bypass.md, agent rules, tests

docs/agents-core.md

@@ -15,6 +15,10 @@ storebound plus you, the AI agent, do the work. The owner is not your pair of ha
    testers. (Also the owner's: canceling a submission, starting or stopping a store experiment, a console form's final
    Submit / Create that a console plan lists in `buttons.final`, signing in and granting account permissions.) For
    these you prepare everything, show the dry run, and the owner presses one button or says yes.
+   **Bypass mode** (`storebound settings bypass status`): when the owner turned it on, you run these owner steps too:
+   MCP `owner_step` (dry run first, then `dry_run: false`), `storebound api ... --yes --confirm <operationId>`, and
+   console plans' `buttons.final`. Say in one line what you pressed; every action is logged to
+   `.storebound/owner-actions.log`. Legal agreements, passwords and 2FA stay with the owner if your own rules say so.
 3. **Ask the owner only for facts that no code, config or doc can prove:** compliance answers such as Data safety,
    App Privacy, age rating, export compliance, partial data deletion. Collect ALL of them in ONE batch at the start
    (`storebound check` and `storebound validate` list them), never one at a time during the run. Reuse answers that

docs/bypass.md

@@ -0,0 +1,30 @@
+# Bypass mode
+
+Default **off**. The owner turns it on once per machine when they want their AI agent to press the owner-only buttons
+too, instead of stopping and asking:
+
+```sh
+storebound settings bypass on      # or answer "y" to the question in storebound init
+storebound settings bypass status
+storebound settings bypass off     # back to the owner pressing every final button, at once
+```
+
+It is stored in `~/.storebound/settings.json` (this machine only), never in a project's config or repo.
+
+## What it unlocks
+
+- MCP: the `owner_step` tool appears. It runs one of: `apple submit`, `apple resubmit`, `apple iap-submit`, `apple release`,
+  `apple preorder`, `play release`, `play rollout`, `reviews` (replies), `apple testflight` (testers), `play products`,
+  `play subscriptions`, `apple iap`, `apple subscriptions`, `prices` (live prices). Dry run first (`dry_run` defaults to
+  true), then `dry_run: false` runs it with `--yes`.
+- `storebound api`: owner-only operations (submit, release, delete, ...) are sent for an agent with
+  `--yes --confirm <operationId>`.
+- Console plans: the agent may press `buttons.final` (Publish, Create app, Send for review) itself.
+
+## What stays
+
+- Every owner action an agent runs is appended to `<project>/.storebound/owner-actions.log` (time, dry or ran, exit
+  code, the command, the last line of its output).
+- Dry runs still come first and must pass.
+- An AI client may still ask the owner for legal agreements, passwords and 2FA codes: those are its own rules, and a
+  storebound setting cannot change them.

docs/desktop-coverage.md

@@ -5,7 +5,7 @@ Every CLI command (cli/commands.ts) and the desktop place that runs it. "covered
 (serve.ts, or a host command `host:`) and the window calls it; tests/desktop-coverage.test.ts fails on a gap.
 Owner-only parts are owner actions in the window or owner steps with their terminal command (More tools).
 
-**95 commands:** 91 covered, 0 gaps, 4 not for the desktop.
+**96 commands:** 91 covered, 0 gaps, 5 not for the desktop.
 
 | command | status | where in the window | methods | owner step |
 |---|---|---|---|---|
@@ -17,6 +17,7 @@ Owner-only parts are owner actions in the window or owner steps with their termi
 | `apps` | covered | Accounts (store apps per account, key check) and App folders (list, add, remove) | `host:store_apps_refresh`, `host:account_check`, `host:projects_list`, `host:project_add`, `host:project_remove` |  |
 | `desktop` | not-for-desktop | opens or installs this window from a terminal |  |  |
 | `accounts` | covered | Accounts screen (profiles shared with the CLI) | `host:accounts_list`, `host:account_add_play`, `host:account_add_apple`, `host:account_update` |  |
+| `settings` | not-for-desktop | per-machine switch for AI agents (bypass mode); in the window the owner presses owner actions in a native dialog anyway |  |  |
 | `doctor` | covered | Dependencies screen | `system.tools`, `host:tools_info` |  |
 | `scan` | covered | Checks tab: Scan, Fix | `scan`, `scan.write` |  |
 | `api` | not-for-desktop | raw API calls by operation id: every task has its own screen, and raw writes stay a terminal step the owner types |  |  |