When using the Cursor 2.0 Agent with Git Worktrees, and the sandbox on by default, Cursor asks to write to every file inside the worktree. When working inside the regular local workspace it writes to files inside the workspace without asking for permission. But when writing to files in a worktree it asks for every file. It makes it really hard to use Cursor for parallel work when it is asking for permission to edit each file.
Steps to Reproduce
Start cursor in the agent tab
Select worktree instead of local
Use any model
Start
Expected Behavior
That Cursor will allow writes to the worktree directory.
Operating System
MacOS
Current Cursor Version (Menu → About Cursor → Copy)
Thanks for the detailed report! This looks like the sandbox isn’t recognizing worktree directories as part of your workspace, which is why it’s asking for permission on every file.
I’ve raised this with the team for investigation.
In the meantime, you might try changing Cursor Settings > Agent > Auto-Run Mode from Run in Sandbox to Run Everything - this might allow worktree writes without the approval prompts. Note that Run Everything mode will automatically execute all commands and file operations without restrictions, so use with caution. Alternatively, you could experiment with allowlist if you prefer more control.
This looks like the sandbox isn’t recognizing worktree directories as part of your workspace, which is why it’s asking for permission on every file.
One thing that might be causing this is that my ~/.cursor directory is symlinked into my dotfiles, because configs like the mcp.json are stored there. So the worktree is behind a symlink.
It would be helpful if the worktree location could be configurable. It would be helpful for my workflows if worktrees lived in a .cursor-worktrees directory within the original git repo.’
I removed the symlink so that the .cursor directory is just a regular directory and requests to edit a file still seem to be requesting permission on first write.
@leighmcculloch we haven’t received this report from other people, so the symlink is very likely to be the cause here.
In the next release (2.1), the worktrees directory will be configurable. In the meantime, even with your new directory, are you still seeing approvals for writing to files on the latest 2.0.x release?
Even with the new directory without symlink the same issue was occurring. For now I’ve gone back to using Cursor CLI and manually managing my own git worktrees instead of the Cursor IDE UI.
@leighmcculloch I’m super sorry about that, I’d appreciate it if you could try again on the latest 2.0.x release or when 2.1 comes out. We don’t have other people reporting this bug so I want to get to the bottom of it, but I’d need your help.
Seeing the same issue using Composer 1, which spawns three chats and tries to write everything to the .git/worktree, but it gets seriously out of sync. This set me back 5% of my monthly tokens, and two days of work to figure out what was going on. I shutoff the sandbox in the agent config.
Solution: This is a Cursor Agent setting, not a git setting.
Fix:
Open Cursor Settings (Cmd+, or File → Preferences → Settings)
Go to Agent → Auto-Run Mode
Change from “Run in Sandbox” (default, uses worktrees) to “Run Everything”
This disables the sandbox/worktree behavior
Note: This runs commands without sandbox restrictions
Alternative: If you want to keep some protection:
Look for “Agent > Git Access” or “Agent > Version Control” settings (this is not a real setting)
Disable AI Git Access or restrict worktree creation
Why this works: Cursor uses worktrees for its sandbox mode. Changing Auto-Run Mode to “Run Everything” bypasses the sandbox and stops creating worktrees.
After changing the setting:
Restart Cursor completely
The worktree creation should stop
Any existing worktrees can be removed manually
The file editing tools here are failing, so I can’t update the settings file directly. Change the Cursor setting in the UI, then restart.
This did not completely fix the issue. I am still dealing with APPLY file change issues to a phantom /worktree that now, does not exist. I means, seriously, this ■■■■■. As an Ultra User, I am considering my options. Should I move on? Not impressed with 2.0.