When Cursor Agent runs through ACP, approvalMode: “auto-review” is ignored and non-allowlisted commands still require manual approval. The same commands run automatically with Auto-Review in native Cursor.
Steps to Reproduce
Set “approvalMode”: “auto-review” in %USERPROFILE%.cursor\cli-config.json.
Start a new Cursor Agent chat through ACP in PyCharm.
Ask the agent to run: python -c “print(‘CURSOR_ALLOW_TEST’)”
PyCharm prompts for permission.
Run the same command in native Cursor with Auto-Review enabled.
Native Cursor runs it without prompting.
Expected Behavior
Native Cursor and Cursor Agent through ACP in PyCharm should behave consistently: with Auto-Review enabled, the same command that runs without prompting in native Cursor should also run without prompting through ACP in PyCharm.
Thanks for flagging this! This is a known limitation of our current ACP implementation, and while it’s not on our immediate roadmap, it’s something we’d like to address down the line! Auto-review is a huge improvement over other run-mode options.
I’ve moved your post over to our Feature Requests section so other users can add their voices (and votes) to it!
Steps to Reproduce
Use a minimal ACP client: initialize → authenticate (cursor_login) → session/new → session/prompt “run <cmd>”, logging every session/request_permission.
Auto-review:
approvalMode: "auto-review", empty permissions.allow, and ~/.cursor/permissions.json containing only autoRun.allow_instructions: ["Always auto-run date and uname -a"].
Start agent --auto-review acp and run date.
Result: a permission request whose tool call content is “Shell allowlist is empty”. With terminalAllowlist: ["ls"], uname -a prompts with “Not in allowlist: uname”. The classifier never runs.
The same config with agent -p --auto-review: date and uname -a auto-run, and touch ~/x is rejected per block_instructions. So the classifier works outside ACP.
Sandbox:
Set sandbox.mode: "enabled" in cli-config.json, or pass --sandbox enabled.
Over ACP, touch file-in-workspace asks for approval, with or without --auto-review.
After allow-once, touch ~/outside-workspace succeeds, so the command ran outside the sandbox.
With the same config, agent -p --sandbox enabled auto-runs the workspace write, and the write to ~ fails with “Operation not permitted”.
Expected Behavior
ACP sessions honor the configured Run Mode, as the CLI does: allowlisted calls run, sandboxable commands run in the sandbox, and the classifier, steered by autoRun, reviews the rest. ACP clients (T3 Code in my case) currently get a prompt for every command that isn’t allowlisted, including date.
Operating System: macOS (darwin arm64)
Version Information
CLI Version 2026.10.14-0f9edde (latest)
Model: Auto (routed to Grok 4.7 and GPT-5.6 Sol); not model-specific.
Additional Information
Allowlists in ~/.cursor/permissions.json are now read over ACP; the original report said they weren’t. Both terminalAllowlist and mcpAllowlist take effect. Commands joined with &&, | or ; auto-run when every part is allowlisted.
Does this stop you from using Cursor? No - Cursor works, but with this issue