docs: document auto_approve_bypasses_command_denylist in the settings reference

[hongyi-chen]

Summary

agents.warp_agent.other.auto_approve_bypasses_command_denylist is a user-facing, GA setting with a toggle in Settings > Agents, but it was missing from the all-settings reference.

Found by the missing_docs drift-watch audit (new setting detected by the snapshot diff) and verified against app/src/settings/ai.rs.

Changes

src/content/docs/terminal/settings/all-settings.mdx

• Added auto_approve_bypasses_command_denylist to the [agents.warp_agent.other] section, with its type and default, and cross-links to the Run until completion and command denylist sections of the agent profiles page.
• Noted that Admin Panel-enforced denylist rules are never bypassed, since that's the part most likely to be misread as a security hole.

Relationship to #424

PR #424 corrected the prose about this behavior on agent-profiles-permissions.mdx. It didn't add the setting to the all-settings reference, which is what the audit checks and what this PR fixes. The two pages now agree.

Source verification

app/src/settings/ai.rs:

• toml_path: "agents.warp_agent.other.auto_approve_bypasses_command_denylist", type: bool, default: true, private: false, surface: SettingSurfaces::ALL.
• No feature_flag, and the toggle is pushed unconditionally in AIInputWidget::render (app/src/settings_view/ai_page.rs), so this is GA.

app/src/ai/blocklist/permissions.rs (can_autoexecute_command) confirms the Admin Panel caveat: bypass_user_denylist additionally requires !AppExecutionMode::is_sandboxed(), and when the bypass applies the code still enforces get_org_execute_commands_denylist(ctx).

Verification

• npm run build passes.
• Internal link check passes (0 broken links); both new anchors resolve to real headings.

Deferred findings from this audit run

The same audit flagged agents.voice.voice_input_hold_key as undocumented. It is SettingSurfaces::TUI (Warp Agent CLI only) and has no desktop-app UI, so it follows the existing convention for CLI-only settings and is mapped internal in the companion audit-bookkeeping PR rather than documented here. Other run-wide deferrals are listed in that PR.

Conversation: https://staging.warp.dev/conversation/53c4f3f8-39bb-46c1-a5c0-66b467db0439
Run: https://oz.staging.warp.dev/runs/019fb91e-74a0-73f4-ac72-f2d88c32fab5

This PR was generated with Oz.

Co-Authored-By: Oz oz-agent@warp.dev

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Jul 31, 2026 5:39pm

[hongyi-chen]

Closing as a duplicate of #430, which already adds auto_approve_bypasses_command_denylist to the [agents.warp_agent.other] section.

Found independently by a missing_docs drift-watch run before I checked open PRs. #430's entry is equivalent (and links both anchors), so no action is needed here.

Co-Authored-By: Oz oz-agent@warp.dev