Agent shell injects BUNDLE_PATH even with required_permissions ["all"] - breaks Ruby/Bundler

Support Bug Reports
, , ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Cursor agent shell injects BUNDLE_PATH and GEM_SPEC_CACHE pointing to cursor-sandbox-cache/ even when the agent uses required_permissions: [“all”]. This breaks bundle, bin/rails, rspec, rubocop, and any Bundler-based command.
My normal terminal works perfectly (bundle check passes, bin/rails runner works). Only the Cursor agent shell fails.
Injected vars (agent shell):
BUNDLE_PATH=/var/folders/…/cursor-sandbox-cache/…/bundle
GEM_SPEC_CACHE=/var/folders/…/cursor-sandbox-cache/…/gem-specs
Same vars are NOT set in my tty. This is a Cursor regression, not a misconfigured local environment.

Regression: worked fine months ago. Started failing in “recent” Cursor versions (3.11.x at least).

Steps to Reproduce

  1. Rails project where bundle check and bin/rails runner work in your normal terminal.
  2. Ask Cursor agent to run: bundle check (or bin/rails runner ‘puts 1’) with required_permissions: [“all”].
  3. Observe Bundler::GemNotFound listing hundreds of “missing” gems.
  4. In the same agent shell session, run: env | grep BUNDLE_PATH
    → value points to cursor-sandbox-cache/
  5. Workaround in same session:
    env -u BUNDLE_PATH -u GEM_SPEC_CACHE bundle check
    → “The Gemfile’s dependencies are satisfied”
    env -u BUNDLE_PATH -u GEM_SPEC_CACHE bin/rails runner ‘puts Clinic.count’
    → works
  6. Compare with tty: env | grep BUNDLE → no sandbox path override.

Expected Behavior

When the agent uses required_permissions: [“all”], the shell environment should match my interactive terminal. No BUNDLE_PATH / GEM_SPEC_CACHE override to cursor-sandbox-cache/. bundle and bin/rails should work without manual env -u workarounds.

Operating System

MacOS

Version Information

Cursor IDE: 3.16.17
macOS: 15.x (darwin 24.6.0), arm64
Ruby: 4.0.5 (rbenv)
Bundler: 4.0.10
Project: Rails 8.1.3.1 app

For AI issues: which model did you use?

Various agent models (Composer, Claude, GPT, Fable, Grok, Kimi K, etc.); issue is shell environment, not model-specific.

Additional Information

Cursor also injects many other sandbox cache paths in agent shell (NPM_CONFIG_CACHE, YARN_CACHE_FOLDER, PNPM_STORE_PATH, etc.) even with all permissions.

Auto-review (Smart Mode) sometimes blocks bin/rails runner even with all permissions, adding a second blocker before a simple command runs.

Suggested fix: when required_permissions [“all”] is requested, do NOT inject BUNDLE_PATH, GEM_SPEC_CACHE, or other sandbox cache overrides into the host environment.

This is not a user configuration issue. I deliberately use Ruby 4.0.5, rbenv is correctly set up, and everything works in my terminal. Cursor pollutes the agent environment and agents misdiagnose it as “broken local env”, wasting tokens on token loops.

Does this stop you from using Cursor

Sometimes - I can sometimes use Cursor

7

Thanks for the detailed write-up, Paul. This isn’t caused by your rbenv or Bundler setup.

The agent shell can still set BUNDLE_PATH to a cursor-sandbox-cache path, even with full permissions. Bundler then looks for gems only in that empty directory, so bundle, bin/rails, RSpec, and RuboCop fail.

We’ve let the team know, and this is an issue we’re tracking. I’ll post here when I have an update.

Until then, the workaround you found is the right one:

env -u BUNDLE_PATH -u GEM_SPEC_CACHE bundle check