Cursor’s “Chat” and “Composer” (“normal” mode) do not have access to your entire project. They also have access to “recently viewed” files (reference). Cursor’s “Composer” (“agent” mode) has implicit access to your entire project (and might not respect .cursorignore nor .gitignore).