— 07 / 第七章

管住它 · 模型、权限、命令审查.

一个会自己跑命令的 agent，信任是要管的。这章给三个旋钮：挑模型（Warp 自带额度，BYOK 用你自己的 OpenAI / Anthropic / Google key，或 custom endpoint 接 OpenAI-compatible 网关）、定权限（从每步都问，到全放行的 YOLO，加上 allowlist / denylist）、审命令（它要跑什么、改了什么，在 Code Review 面板里看）。放它自动跑之前，先把这三样调到你睡得着的位置。An agent that runs commands on its own is a trust you have to manage. Three knobs: pick the model (Warp's bundled credits, BYOK with your own OpenAI / Anthropic / Google key, or a custom endpoint for an OpenAI-compatible gateway), set permissions (from ask-every-step to full-allow YOLO, plus allowlist / denylist), and review commands (what it is about to run and what it changed, in the Code Review pane). Before you let it run on its own, set these three where you can sleep.

8 分钟 · 初稿 2026.06 · v3 2026.07.10

一个会自己跑命令、还能接外部工具的 agent，信任是要管的 —— 不能全凭它自觉。这章给三个旋钮：挑模型（自带额度还是 BYOK）、定权限（从每步都问到全放行）、审命令（它要跑什么、改了什么）。放它自动跑之前，先把这三样调到你睡得着的位置。

— I

挑模型：官方 credits、BYOK、custom endpoint.

模型这件事现在有三条路：用 Warp 官方模型和 credits，BYOK 接自己的 provider key，或者 custom inference endpoint 接自己的网关。截至 2026-07-10，官方 Model Choice 里有 Auto 模式、OpenAI、Anthropic、Google、xAI 与 Fireworks-hosted open-weight 模型；你可以让 Warp 自动选，也可以指定模型。4注 4Warp Docs · Agent model choice —— 截至 2026-07-10，Model Choice 支持 Auto 模式、OpenAI、Anthropic、Google、xAI 与 Fireworks-hosted open-weight 模型；Auto 模型会按任务选择但仍消耗 Warp credits；Grok 模型可通过连接 SuperGrok 订阅走 xAI 账号而非 Warp credits；ZDR 可用性按模型变化。BYOK 支持 OpenAI、Anthropic、Google，Free 与符合条件的付费档可用；选中带 key 图标的具体模型时，推理费用走你的 provider 账单，不消耗 Warp AI credits。2注 2Warp Docs · Bring Your Own API Key —— 截至 2026-07-10，BYOK 支持 OpenAI、Anthropic、Google；Free 与符合条件的付费档可用（个人及 10 人以内组织，大组织需 Business / Enterprise）；key 存本地但请求会经 Warp backend in-flight；用户级 BYOK 不适用于 Cloud Agents —— Enterprise 可由管理员配 team-managed keys（Warp 服务端保存），本地与云端都能用。Warp Docs · Bring Your Own API Key — as of 2026-07-10, BYOK supports OpenAI, Anthropic, and Google; available on Free and eligible paid plans for individuals/orgs up to 10 employees, while larger orgs need Business / Enterprise; keys are stored locally but requests transit Warp's backend in-flight; user-level BYOK does not apply to Cloud Agents — on Enterprise, admins can configure team-managed keys (stored server-side by Warp) that work both locally and in the cloud.（Grok 是另一条路：不填 API key，连接你的 SuperGrok 订阅，用 xAI 账号的额度跑 Grok 模型。4注 4Warp Docs · Agent model choice —— 截至 2026-07-10，Model Choice 支持 Auto 模式、OpenAI、Anthropic、Google、xAI 与 Fireworks-hosted open-weight 模型；Auto 模型会按任务选择但仍消耗 Warp credits；Grok 模型可通过连接 SuperGrok 订阅走 xAI 账号而非 Warp credits；ZDR 可用性按模型变化。）custom inference endpoint 则接任何 OpenAI-compatible endpoint，比如 OpenRouter、LiteLLM、z.ai 或公开 HTTPS 的内部网关；localhost 和私网 endpoint 不行。3注 3Warp Docs · Custom inference endpoint —— 截至 2026-07-10，自定义 endpoint 支持 OpenAI-compatible Chat Completions API，可接 OpenRouter、LiteLLM、z.ai 或公开 HTTPS 的内部网关；localhost / 私网地址会被拒绝（本机模型可经 ngrok 等隧道暴露成公网 HTTPS 后接入）；custom endpoint 不适用于 Cloud Agents。As of 2026-07-10, official Model Choice includes Auto modes, OpenAI, Anthropic, Google, xAI, and Fireworks-hosted open-weight models; you can let Warp auto-select or choose explicitly.4注 4Warp Docs · Agent model choice —— 截至 2026-07-10，Model Choice 支持 Auto 模式、OpenAI、Anthropic、Google、xAI 与 Fireworks-hosted open-weight 模型；Auto 模型会按任务选择但仍消耗 Warp credits；Grok 模型可通过连接 SuperGrok 订阅走 xAI 账号而非 Warp credits；ZDR 可用性按模型变化。 BYOK supports OpenAI, Anthropic, and Google, and is available on Free and eligible paid plans; when you select a concrete key-icon model, inference is billed to your provider account and does not consume Warp AI credits.2注 2Warp Docs · Bring Your Own API Key —— 截至 2026-07-10，BYOK 支持 OpenAI、Anthropic、Google；Free 与符合条件的付费档可用（个人及 10 人以内组织，大组织需 Business / Enterprise）；key 存本地但请求会经 Warp backend in-flight；用户级 BYOK 不适用于 Cloud Agents —— Enterprise 可由管理员配 team-managed keys（Warp 服务端保存），本地与云端都能用。Warp Docs · Bring Your Own API Key — as of 2026-07-10, BYOK supports OpenAI, Anthropic, and Google; available on Free and eligible paid plans for individuals/orgs up to 10 employees, while larger orgs need Business / Enterprise; keys are stored locally but requests transit Warp's backend in-flight; user-level BYOK does not apply to Cloud Agents — on Enterprise, admins can configure team-managed keys (stored server-side by Warp) that work both locally and in the cloud. (Grok takes a different route: no API key — connect your SuperGrok subscription and run Grok models on your xAI account.4注 4Warp Docs · Agent model choice —— 截至 2026-07-10，Model Choice 支持 Auto 模式、OpenAI、Anthropic、Google、xAI 与 Fireworks-hosted open-weight 模型；Auto 模型会按任务选择但仍消耗 Warp credits；Grok 模型可通过连接 SuperGrok 订阅走 xAI 账号而非 Warp credits；ZDR 可用性按模型变化。) A custom inference endpoint connects any OpenAI-compatible endpoint such as OpenRouter, LiteLLM, z.ai, or a public-HTTPS internal gateway; localhost and private-network endpoints do not work.3注 3Warp Docs · Custom inference endpoint —— 截至 2026-07-10，自定义 endpoint 支持 OpenAI-compatible Chat Completions API，可接 OpenRouter、LiteLLM、z.ai 或公开 HTTPS 的内部网关；localhost / 私网地址会被拒绝（本机模型可经 ngrok 等隧道暴露成公网 HTTPS 后接入）；custom endpoint 不适用于 Cloud Agents。模型这个旋钮上最近多了一层：custom model router（2026-06-24 的版本起）。它不是第四条账本，是把「每次手挑模型」变成一条写好一次的策略：在设置里建，或写一个 YAML 放进 ~/.warp/custom_model_routers/，按任务复杂度分档（easy / medium / hard 各指一个模型，外加必填的兜底），或用自然语言规则自上而下匹配 —— 「改数据库迁移」走便宜的开源模型，「排查生产事故」走 frontier 模型。router 出现在模型选择器里，像选模型一样选它，每次请求解析成一个具体模型，你始终能看到实际跑的是哪个。两条边界要知道：router 和 Auto 一样只走 Warp credits，配了 BYOK 也不碰你的 key —— 想省 credits 仍要手选带 key 图标的模型；Team-synced routers（管理员给全团队共享）是 Enterprise 功能。5注 5Warp Docs · Custom routers —— 截至 2026-07-10，自定义 router 在设置里创建或以 YAML 存在 ~/.warp/custom_model_routers/，按任务复杂度（easy / medium / hard 加必填 default）或自然语言规则（自上而下、首条命中）把每次请求解析到一个具体模型；router 与 Auto 一样消耗 Warp credits、不走 BYOK key；Team-synced routers 是 Enterprise 功能。Warp Docs · Custom routers — as of 2026-07-10, a custom router is created in Settings or authored as YAML in ~/.warp/custom_model_routers/, and resolves each request to one concrete model either by task complexity (easy / medium / hard plus a required default) or by natural-language rules matched top to bottom; like Auto, routers consume Warp credits and never draw on BYOK keys; team-synced routers are an Enterprise feature.The model knob recently gained a layer: custom model routers (since the 2026-06-24 release). Not a fourth ledger — it turns picking a model by hand each time into a policy you write once: create it in Settings, or drop a YAML file into ~/.warp/custom_model_routers/, and route either by task complexity (a model each for easy / medium / hard, plus a required default) or by natural-language rules matched top to bottom — database migrations go to a cheap open-weight model, production incident debugging goes to a frontier model. The router shows up in the model picker, you select it like any model, each request resolves to one concrete model, and you can always see which one actually ran. Two boundaries to know: like Auto, a router only spends Warp credits and never touches your BYOK key — to save credits you still hand-pick a key-icon model; and team-synced routers (admin-shared with the whole team) are an Enterprise feature.5注 5Warp Docs · Custom routers —— 截至 2026-07-10，自定义 router 在设置里创建或以 YAML 存在 ~/.warp/custom_model_routers/，按任务复杂度（easy / medium / hard 加必填 default）或自然语言规则（自上而下、首条命中）把每次请求解析到一个具体模型；router 与 Auto 一样消耗 Warp credits、不走 BYOK key；Team-synced routers 是 Enterprise 功能。Warp Docs · Custom routers — as of 2026-07-10, a custom router is created in Settings or authored as YAML in ~/.warp/custom_model_routers/, and resolves each request to one concrete model either by task complexity (easy / medium / hard plus a required default) or by natural-language rules matched top to bottom; like Auto, routers consume Warp credits and never draw on BYOK keys; team-synced routers are an Enterprise feature.

模型路径	适合	你承担什么
官方模型 / official credits	省心、Auto、custom routers、Cloud Agents、团队默认使用	credits、模型可用性、计划限制
BYOK	已有 OpenAI / Anthropic / Google 账单，希望控制 provider 成本	API key 安全、provider 成本、rate limit、provider 数据策略
custom inference endpoint	OpenAI-compatible router / gateway / self-hosted public endpoint	兼容性、公开可达性、延迟、稳定性、日志与隐私
local model	仅当通过公开 HTTPS 的 OpenAI-compatible gateway 暴露给 Warp	它不是本机 localhost 直连

— 注意

两个边界要写死：你本机配的 BYOK 和 custom endpoint 都不适用于 Cloud Agents —— key 存在你设备上，云端 run 拿不到，cloud run 照常消耗 Warp credits（Enterprise 例外：管理员在 Admin Panel 配的 team-managed keys / endpoints 由 Warp 服务端保存，本地和云端都能用）。Auto 模型和 custom router 也总是走 Warp credits。2注 2Warp Docs · Bring Your Own API Key —— 截至 2026-07-10，BYOK 支持 OpenAI、Anthropic、Google；Free 与符合条件的付费档可用（个人及 10 人以内组织，大组织需 Business / Enterprise）；key 存本地但请求会经 Warp backend in-flight；用户级 BYOK 不适用于 Cloud Agents —— Enterprise 可由管理员配 team-managed keys（Warp 服务端保存），本地与云端都能用。Warp Docs · Bring Your Own API Key — as of 2026-07-10, BYOK supports OpenAI, Anthropic, and Google; available on Free and eligible paid plans for individuals/orgs up to 10 employees, while larger orgs need Business / Enterprise; keys are stored locally but requests transit Warp's backend in-flight; user-level BYOK does not apply to Cloud Agents — on Enterprise, admins can configure team-managed keys (stored server-side by Warp) that work both locally and in the cloud.3注 3Warp Docs · Custom inference endpoint —— 截至 2026-07-10，自定义 endpoint 支持 OpenAI-compatible Chat Completions API，可接 OpenRouter、LiteLLM、z.ai 或公开 HTTPS 的内部网关；localhost / 私网地址会被拒绝（本机模型可经 ngrok 等隧道暴露成公网 HTTPS 后接入）；custom endpoint 不适用于 Cloud Agents。5注 5Warp Docs · Custom routers —— 截至 2026-07-10，自定义 router 在设置里创建或以 YAML 存在 ~/.warp/custom_model_routers/，按任务复杂度（easy / medium / hard 加必填 default）或自然语言规则（自上而下、首条命中）把每次请求解析到一个具体模型；router 与 Auto 一样消耗 Warp credits、不走 BYOK key；Team-synced routers 是 Enterprise 功能。Warp Docs · Custom routers — as of 2026-07-10, a custom router is created in Settings or authored as YAML in ~/.warp/custom_model_routers/, and resolves each request to one concrete model either by task complexity (easy / medium / hard plus a required default) or by natural-language rules matched top to bottom; like Auto, routers consume Warp credits and never draw on BYOK keys; team-synced routers are an Enterprise feature.所以别把 BYOK 理解成「所有 Warp AI 都不花 Warp 钱」。Two boundaries are fixed: the BYOK and custom endpoint you configure locally do not apply to Cloud Agents — the key lives on your device, cloud runs can't reach it, and they consume Warp credits as usual (the Enterprise exception: team-managed keys / endpoints an admin sets in the Admin Panel are stored server-side by Warp and work both locally and in the cloud). Auto models and custom routers also always spend Warp credits.2注 2Warp Docs · Bring Your Own API Key —— 截至 2026-07-10，BYOK 支持 OpenAI、Anthropic、Google；Free 与符合条件的付费档可用（个人及 10 人以内组织，大组织需 Business / Enterprise）；key 存本地但请求会经 Warp backend in-flight；用户级 BYOK 不适用于 Cloud Agents —— Enterprise 可由管理员配 team-managed keys（Warp 服务端保存），本地与云端都能用。Warp Docs · Bring Your Own API Key — as of 2026-07-10, BYOK supports OpenAI, Anthropic, and Google; available on Free and eligible paid plans for individuals/orgs up to 10 employees, while larger orgs need Business / Enterprise; keys are stored locally but requests transit Warp's backend in-flight; user-level BYOK does not apply to Cloud Agents — on Enterprise, admins can configure team-managed keys (stored server-side by Warp) that work both locally and in the cloud.3注 3Warp Docs · Custom inference endpoint —— 截至 2026-07-10，自定义 endpoint 支持 OpenAI-compatible Chat Completions API，可接 OpenRouter、LiteLLM、z.ai 或公开 HTTPS 的内部网关；localhost / 私网地址会被拒绝（本机模型可经 ngrok 等隧道暴露成公网 HTTPS 后接入）；custom endpoint 不适用于 Cloud Agents。5注 5Warp Docs · Custom routers —— 截至 2026-07-10，自定义 router 在设置里创建或以 YAML 存在 ~/.warp/custom_model_routers/，按任务复杂度（easy / medium / hard 加必填 default）或自然语言规则（自上而下、首条命中）把每次请求解析到一个具体模型；router 与 Auto 一样消耗 Warp credits、不走 BYOK key；Team-synced routers 是 Enterprise 功能。Warp Docs · Custom routers — as of 2026-07-10, a custom router is created in Settings or authored as YAML in ~/.warp/custom_model_routers/, and resolves each request to one concrete model either by task complexity (easy / medium / hard plus a required default) or by natural-language rules matched top to bottom; like Auto, routers consume Warp credits and never draw on BYOK keys; team-synced routers are an Enterprise feature. So do not read BYOK as "all Warp AI stops spending Warp credits."

准备在 Warp 里配置 BYOK / custom endpoint。
先确认：
- 我用的是具体 provider model，不是 Auto；
- 这个 key 的权限最小、可撤销、有预算上限；
- provider 侧 retention / training 设置符合项目要求；
- 我知道请求会经 Warp backend in-flight；
- 这不会覆盖 Cloud Agents；
- 出错时是否允许 fallback 到 Warp credits。Preparing to configure BYOK / custom endpoint in Warp.
Confirm first:
- I will select a concrete provider model, not Auto;
- the key has minimal permissions, can be revoked, and has a budget limit;
- provider-side retention/training settings match the project;
- I know requests transit Warp's backend in-flight;
- this will not cover Cloud Agents;
- whether fallback to Warp credits is allowed on failure.

准备在 Warp 里配置 Anthropic BYOK。
先确认：
- 我选的是 Claude Sonnet 这个具体模型，不是 Auto；
- 这个 Anthropic key 只开了 inference 权限、能在控制台一键撤销、设了每月 50 美元上限；
- Anthropic 侧 retention 设为 30 天、已关掉 training，符合项目要求；
- 我知道请求会经 Warp backend in-flight；
- 这不会覆盖 Cloud Agents；
- 出错时允许 fallback 到 Warp credits。Preparing to configure Anthropic BYOK in Warp.
Confirm first:
- I will select the concrete model Claude Sonnet, not Auto;
- this Anthropic key has inference-only permission, can be revoked from the console in one click, and has a $50/month budget limit;
- Anthropic-side retention is set to 30 days with training off, which matches the project;
- I know requests transit Warp's backend in-flight;
- this will not cover Cloud Agents;
- fallback to Warp credits is allowed on failure.

— II

定权限：从每步都问到 YOLO.

自主度不是一个开关，是一条从「每步都问」到「全放行」的滑杆 —— 你该停在中间。四档权限（Agent Decides / Always ask / Always allow / Never）分别管读文件、做计划、执行命令、调 MCP，常用的中间档是「确信就做、不确定才问」。两侧用清单兜底：allowlist 在 Settings > Agents > Profiles > Command allowlist，接正则，把你信得过的只读命令放进去自动跑；denylist 放绝不能自动跑的，且它优先于 allowlist 和「Agent decides」，命中必须人工批准。1注 1Warp Docs · Agent Profiles & Permissions —— 截至 2026-07-10，Profile 可配置 base model、autonomy、tool access、读文件/计划/执行命令/Full Terminal Use/MCP 等权限，每项分 Agent Decides / Always ask / Always allow / Never 四档；allowlist 接正则，denylist 优先于 allowlist 与 Agent Decides；Run until completion 会绕过 denylist。Warp Docs · Agent Profiles & Permissions — as of 2026-07-10, Profiles configure base model, autonomy, tool access, and permissions for reading files, planning, executing commands, Full Terminal Use, MCP, and more, each at Agent Decides / Always ask / Always allow / Never; allowlists take regex, the denylist takes precedence over the allowlist and Agent Decides, and Run until completion bypasses the denylist.Four permission tiers (Agent Decides / Always ask / Always allow / Never) govern reading files, making plans, executing commands, and calling MCP; the everyday middle setting is act-when-confident-ask-when-unsure. Backstop both ends with lists: the allowlist lives at Settings > Agents > Profiles > Command allowlist, takes regex, and auto-runs the read-only commands you trust; the denylist holds what must never auto-run, and it takes precedence over both the allowlist and 'Agent decides,' a match always needing manual approval.1注 1Warp Docs · Agent Profiles & Permissions —— 截至 2026-07-10，Profile 可配置 base model、autonomy、tool access、读文件/计划/执行命令/Full Terminal Use/MCP 等权限，每项分 Agent Decides / Always ask / Always allow / Never 四档；allowlist 接正则，denylist 优先于 allowlist 与 Agent Decides；Run until completion 会绕过 denylist。Warp Docs · Agent Profiles & Permissions — as of 2026-07-10, Profiles configure base model, autonomy, tool access, and permissions for reading files, planning, executing commands, Full Terminal Use, MCP, and more, each at Agent Decides / Always ask / Always allow / Never; allowlists take regex, the denylist takes precedence over the allowlist and Agent Decides, and Run until completion bypasses the denylist.

Profile 名称：<safe-ops / local-dev / sandbox-yolo>
Base model：<model>
默认自主度：<Agent decides / Always ask / Always allow / Never>
允许自动读：<目录/文件类型>
允许自动执行：<只读命令正则>
必须询问：写入、删除、网络下载、sudo、MCP 写工具
禁止：生产数据库写入、deploy、secret 输出、home 目录批量改动
验收：每次结束必须给命令列表、变更 diff、验证命令和结果。Profile name: <safe-ops / local-dev / sandbox-yolo>
Base model: <model>
Default autonomy: <Agent decides / Always ask / Always allow / Never>
Auto-read allowed: <directories/file types>
Auto-execute allowed: <read-only command regex>
Must ask: writes, deletes, network downloads, sudo, MCP write tools
Forbidden: production DB writes, deploys, secret output, bulk home-directory changes
Acceptance: every run ends with command list, change diff, verification command and result.

Profile 名称：local-dev
Base model：Claude Sonnet
默认自主度：Agent decides
允许自动读：./src 下的 .ts / .tsx 和 package.json
允许自动执行：^(ls|cat|git (status|diff|log)|npm run lint)\b
必须询问：写入、删除、网络下载、sudo、MCP 写工具
禁止：生产数据库写入、deploy、secret 输出、home 目录批量改动
验收：每次结束必须给命令列表、变更 diff、验证命令和结果。Profile name: local-dev
Base model: Claude Sonnet
Default autonomy: Agent decides
Auto-read allowed: .ts / .tsx and package.json under ./src
Auto-execute allowed: ^(ls|cat|git (status|diff|log)|npm run lint)\b
Must ask: writes, deletes, network downloads, sudo, MCP write tools
Forbidden: production DB writes, deploys, secret output, bulk home-directory changes
Acceptance: every run ends with command list, change diff, verification command and result.

# allowlist — 只读、低风险，自动免确认跑
which .*
ls(\s.*)?
grep(\s.*)?
git (status|diff|log)(\s.*)?
 
# denylist — 优先级最高，命中永远要你点头
rm\s+-rf?\s.*
.*\bdrop\s+(table|database)\b.*
kubectl\s+.*\bdelete\b.*

起步 allowlist / denylist（正则）

— 注意

一档要单独警告：「Run until completion」（⌘⇧I / Ctrl+Shift+I）连 denylist 都不看 —— 它是最纯的 YOLO，agent 一路跑到底、什么都不问，你写在 denylist 里的 rm -rf、drop 也拦不住。1注 1Warp Docs · Agent Profiles & Permissions —— 截至 2026-07-10，Profile 可配置 base model、autonomy、tool access、读文件/计划/执行命令/Full Terminal Use/MCP 等权限，每项分 Agent Decides / Always ask / Always allow / Never 四档；allowlist 接正则，denylist 优先于 allowlist 与 Agent Decides；Run until completion 会绕过 denylist。Warp Docs · Agent Profiles & Permissions — as of 2026-07-10, Profiles configure base model, autonomy, tool access, and permissions for reading files, planning, executing commands, Full Terminal Use, MCP, and more, each at Agent Decides / Always ask / Always allow / Never; allowlists take regex, the denylist takes precedence over the allowlist and Agent Decides, and Run until completion bypasses the denylist.只在沙箱或一次性环境里开，别在能碰到生产或重要数据的机器上用。One setting needs its own warning: 'Run until completion' (⌘⇧I / Ctrl+Shift+I) ignores even the denylist — it's the purest YOLO, the agent runs to the end asking nothing, and the rm -rf or drop you put on the denylist won't stop it.1注 1Warp Docs · Agent Profiles & Permissions —— 截至 2026-07-10，Profile 可配置 base model、autonomy、tool access、读文件/计划/执行命令/Full Terminal Use/MCP 等权限，每项分 Agent Decides / Always ask / Always allow / Never 四档；allowlist 接正则，denylist 优先于 allowlist 与 Agent Decides；Run until completion 会绕过 denylist。Warp Docs · Agent Profiles & Permissions — as of 2026-07-10, Profiles configure base model, autonomy, tool access, and permissions for reading files, planning, executing commands, Full Terminal Use, MCP, and more, each at Agent Decides / Always ask / Always allow / Never; allowlists take regex, the denylist takes precedence over the allowlist and Agent Decides, and Run until completion bypasses the denylist. Only in a sandbox or throwaway environment; never on a machine that can reach production or data that matters.

— III

审命令：它要跑什么、改了什么.

放手不等于不看 —— 它跑前给你命令，跑后给你 diff，这两眼你得花。默认让它「先给命令、确认再跑」，把要执行的那行摆到你眼前；改动则进 Code Review 面板，diff 框起来看，而不是淹在终端输出里。信任是分类建立的：同一类命令你审过几次没问题，就把它的正则挪进 allowlist；没底的那类，一直留在「每次问」。别一上来就全放，也别永远每步都拦 —— 按命令类别逐步松手。By default have it 'show the command, confirm, then run,' putting the exact line in front of you; changes go to the Code Review pane, where the diff is framed rather than buried in terminal output. Trust is built by category: once you've reviewed a class of command a few times without issue, move its regex to the allowlist; the classes you're unsure of stay on 'ask every time.' Don't open everything at once, and don't block every step forever — loosen by command class.

命令审查：目录对不对、账号对不对、环境变量对不对。
命令审查：有没有删除、覆盖、权限变更、网络下载、sudo、生产 host。
命令审查：能不能先 dry-run、小样本、只读 SELECT。
成本控制：Auto 和 custom router 都消耗 Warp credits；BYOK/custom endpoint 的 provider 账单也要设预算。
成本控制：Cloud Agents 不走 BYOK；上云前先看 credit 余额和验收方式。

给你的 agent 设一个你睡得着的 Profile：

选好模型路径：官方 credits、BYOK，还是 custom inference endpoint。
往 allowlist 加几条只读命令的正则（git (status|diff|log).* 之类）。
往 denylist 加 rm -rf、drop、和任何指向生产的命令。
把自主度设成「确信才做、不确定就问」，并确认你没误开「Run until completion」。
记住：BYOK / custom endpoint 不覆盖 Cloud Agents；上云就按 Warp credits 算。

— 引用与参考

参考.

01
Warp Docs · Agent Profiles & Permissions —— 截至 2026-07-10，Profile 可配置 base model、autonomy、tool access、读文件/计划/执行命令/Full Terminal Use/MCP 等权限，每项分 Agent Decides / Always ask / Always allow / Never 四档；allowlist 接正则，denylist 优先于 allowlist 与 Agent Decides；Run until completion 会绕过 denylist。Warp Docs · Agent Profiles & Permissions — as of 2026-07-10, Profiles configure base model, autonomy, tool access, and permissions for reading files, planning, executing commands, Full Terminal Use, MCP, and more, each at Agent Decides / Always ask / Always allow / Never; allowlists take regex, the denylist takes precedence over the allowlist and Agent Decides, and Run until completion bypasses the denylist. Warp Docs · Profiles & Permissions
↩
02
Warp Docs · Bring Your Own API Key —— 截至 2026-07-10，BYOK 支持 OpenAI、Anthropic、Google；Free 与符合条件的付费档可用（个人及 10 人以内组织，大组织需 Business / Enterprise）；key 存本地但请求会经 Warp backend in-flight；用户级 BYOK 不适用于 Cloud Agents —— Enterprise 可由管理员配 team-managed keys（Warp 服务端保存），本地与云端都能用。Warp Docs · Bring Your Own API Key — as of 2026-07-10, BYOK supports OpenAI, Anthropic, and Google; available on Free and eligible paid plans for individuals/orgs up to 10 employees, while larger orgs need Business / Enterprise; keys are stored locally but requests transit Warp's backend in-flight; user-level BYOK does not apply to Cloud Agents — on Enterprise, admins can configure team-managed keys (stored server-side by Warp) that work both locally and in the cloud. Warp Docs · BYOK
↩
03
Warp Docs · Custom inference endpoint —— 截至 2026-07-10，自定义 endpoint 支持 OpenAI-compatible Chat Completions API，可接 OpenRouter、LiteLLM、z.ai 或公开 HTTPS 的内部网关；localhost / 私网地址会被拒绝（本机模型可经 ngrok 等隧道暴露成公网 HTTPS 后接入）；custom endpoint 不适用于 Cloud Agents。 Warp Docs · Custom endpoint
↩
04
Warp Docs · Agent model choice —— 截至 2026-07-10，Model Choice 支持 Auto 模式、OpenAI、Anthropic、Google、xAI 与 Fireworks-hosted open-weight 模型；Auto 模型会按任务选择但仍消耗 Warp credits；Grok 模型可通过连接 SuperGrok 订阅走 xAI 账号而非 Warp credits；ZDR 可用性按模型变化。 Warp Docs · Model choice
↩
05
Warp Docs · Custom routers —— 截至 2026-07-10，自定义 router 在设置里创建或以 YAML 存在 ~/.warp/custom_model_routers/，按任务复杂度（easy / medium / hard 加必填 default）或自然语言规则（自上而下、首条命中）把每次请求解析到一个具体模型；router 与 Auto 一样消耗 Warp credits、不走 BYOK key；Team-synced routers 是 Enterprise 功能。Warp Docs · Custom routers — as of 2026-07-10, a custom router is created in Settings or authored as YAML in ~/.warp/custom_model_routers/, and resolves each request to one concrete model either by task complexity (easy / medium / hard plus a required default) or by natural-language rules matched top to bottom; like Auto, routers consume Warp credits and never draw on BYOK keys; team-synced routers are an Enterprise feature. Warp Docs · Custom routers
↩

你能放手的程度，取决于你设界的程度.

How far you can let go is how far you set the bounds.

Aklman Library

— 讨论

讨论.

评论区初始化中…

管住它 · 模型、权限、命令审查Keep It in Check · Models, Permissions, Command Review.

挑模型：官方 credits、BYOK、custom endpointPick the Model: Official Credits, BYOK, Custom Endpoint.

定权限：从每步都问到 YOLOSet Permissions: From Ask-Every-Step to YOLO.

审命令：它要跑什么、改了什么Review Commands: What It'll Run, What It Changed.

讨论Discussion.

管住它 · 模型、权限、命令审查.

挑模型：官方 credits、BYOK、custom endpoint.

定权限：从每步都问到 YOLO.

审命令：它要跑什么、改了什么.

讨论.