Sign up
View stargazersSign up

[Bug]: Cursor threads in Auto never get Cursor Auto-review, so every sandbox escalation is rejected#19711

opened26d agobyOowenferg

Before submitting

  • I searched existing issues and did not find a duplicate.
  • I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

  1. Start a Cursor thread in Auto.
  2. Ask the agent to run something that needs to leave Cursor's sandbox, for example touch ~/.t3-sandbox-probe (writes outside the workspace) or any command that needs network.
  3. The agent retries with elevated permissions (required_permissions: ["all"]).

Expected behavior

Permission modes says Auto "uses the provider's automatic review to approve routine actions" and lists Cursor among the providers that have it. So in Auto, Cursor's Auto-review classifier should get to decide sandbox escalations, the same way Cursor's own Auto-review run mode does.

Actual behavior

Every escalation is rejected immediately, without any review or prompt:

text
1Rejected: Local SDK runs cannot request interactive approval for this shell command. Keep the action within the configured sandbox policy or Smart Auto Review's auto-approval boundary, or re-run without sandboxing/autoReview enabled.

The agent is stuck inside the sandbox (workspace-only writes, no network). The only way out is switching the thread to Full access, which turns the sandbox off entirely.

Cause: cursorRuntimeAgentPolicy in packages/provider-cursor/src/server/adapter.ts only enables autoReview for approval-required:

ts
1autoReview:
2 runtimePolicy.approvalPolicy === undefined
3 ? runtimePolicy.runtimeMode === "approval-required"
4 : runtimePolicy.approvalPolicy !== "never",

Cursor doesn't declare supportedRuntimeModes, so auto reaches the adapter unchanged and gets autoReview: false with sandboxEnabled: true. In @cursor/sdk 1.0.35, a sandboxed local run then uses a pending-decision provider that always denies, and the Auto-review classifier is only consulted when autoReview === true (getSmartModeClassifierAutoModeEnabled: () => autoReview === true). The cursorRuntimeAgentPolicy tests cover full access, auto-accept-edits, and approval-required, but not auto.

Impact

Major degradation or frequent failure

Version or commit

t3 v0.0.46-nightly.20261014.3132 (source: main @ ec1313c8)

Environment

macOS 27.0.1, Apple Silicon, T3 Code desktop nightly, Cursor provider via bundled @cursor/sdk 1.0.35

Logs or stack traces

shell
1# Cursor thread in Auto
2$ touch ~/.t3-sandbox-probe
3touch: /Users/owen/.t3-sandbox-probe: Operation not permitted
4
5# same command, retried with required_permissions: ["all"]
6Rejected: Local SDK runs cannot request interactive approval for this shell command. ...
7
8# same thread after switching to Full access
9$ touch ~/.t3-sandbox-probe && echo WRITE_OK
10WRITE_OK

Screenshots, recordings, or supporting files

No response

Workaround

Use Full access for Cursor threads that need to write outside the workspace or reach the network.

A fix is ready on a branch: it enables autoReview for auto as well, and adds the missing auto case to the policy test.

Separate from this fix: Supervised currently also gets autoReview: true, so Cursor's AI classifier can approve escalations in a mode the docs describe as asking the user. That's the same question #19293 raised for Muse. I left it alone here because the SDK has no interactive approval callback, so turning Auto-review off in Supervised would mean every escalation is denied rather than asked about.

Related: #15775 (sandboxed Cursor threads get no default network allowlist).

JJulius Marminge26d ago

Note

Grok responding on behalf of Julius.

This is a confirmed bug, and it's a regression. Auto is supposed to turn on Cursor's Auto-review. That was deliberate in #9283, which launched the Cursor CLI with --auto-review in Auto. When the adapter moved to @cursor/sdk, that mapping was lost. On main, cursorRuntimeAgentPolicy in packages/provider-cursor/src/server/adapter.ts sets autoReview only for approval-required but keeps sandboxEnabled on for everything except Full access. So an Auto thread runs sandboxed with no reviewer, and every escalation is denied. That contradicts docs/user/permission-modes.md, which lists Cursor among the providers whose Auto uses automatic review. #10510 (adding the sandbox in Auto) was closed only because of the V2 freeze, not as a decision against Auto-review.

Workaround: for now, switch the thread to Full access when it needs to write outside the workspace or use the network.

The fix is to enable autoReview for auto and add the missing auto case to the policy tests. #15775 (no default network allowlist for sandboxed Cursor threads) is related but separate.

Whether Cursor's classifier should keep auto-approving escalations in Supervised (the same question #19293 raised for Muse) is a separate product question. It isn't decided here.