Cursor-agent (sandboxed): worker.sock ignores CURSOR_DATA_DIR and is created at literal /tmp/.cursor/<workspace-key>/

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Cursor CLI

Describe the Bug

When cursor agent runs inside a macOS seatbelt sandbox AND CURSOR_DATA_DIR is set, the worker IPC socket is created at the literal path /tmp/.cursor/<workspace-key>/worker.sock instead of under $CURSOR_DATA_DIR/projects/<workspace-key>/ where it normally lives. Setting CURSOR_SANDBOX_POLICY_DIR makes no difference, TMPDIR does not move it, and --sandbox disabled does not suppress it. Unsandboxed runs — or sandboxed runs with the default ~/.cursor data dir — never touch /tmp/.cursor.

Why it matters: the relocation variables exist so embedders can give each agent instance private state. The hardcoded /tmp/.cursor fallback defeats that: a sandboxed embedder must grant write access to a fixed world-visible directory, and concurrent agents on the same workspace share one socket directory.

Expected: the socket to live under $CURSOR_DATA_DIR/projects/<workspace-key>/, as it does in unsandboxed runs with the same variables.

Ruled out by separate runs: CURSOR_SANDBOX_POLICY_DIR set vs unset (no difference); --yolo vs not (no difference); --sandbox disabled (socket still created there); unsandboxed with identical env including redirected TMPDIR (path never touched — the fallback triggers only when the agent detects it is sandboxed AND the data dir is relocated).

Steps to Reproduce

DATA=$(mktemp -d); CONFIG=$(mktemp -d); WS=$(mktemp -d); SCRATCH=$(mktemp -d)
cat > /tmp/repro.sb <<EOF
(version 1)
(allow default)
(deny file-write*)
(allow file-write* (subpath “$DATA”))
(allow file-write* (subpath “$CONFIG”))
(allow file-write* (subpath “$WS”))
(allow file-write* (subpath “$SCRATCH”))
(allow file-write* (subpath “/dev”))
EOF
printf ‘Reply with exactly: OK\n’ | CURSOR_DATA_DIR=“$DATA” CURSOR_CONFIG_DIR=“$CONFIG” TMPDIR=“$SCRATCH” sandbox-exec -f /tmp/repro.sb cursor agent --print --trust --workspace “$WS” --output-format text

Actual result: startup fails with “Error: EPERM: operation not permitted, mkdir ‘/tmp/.cursor/’” (the workspace path with separators replaced by “-”). Granting /tmp/.cursor in the profile lets the run complete, and worker.sock then appears at /tmp/.cursor//worker.sock — while $CURSOR_DATA_DIR/projects// receives the rest of the state as expected.

Operating System

MacOS

Version Information

cursor-agent 2026.08.04-aaa8809 (CLI), macOS 15 / Darwin 25.5.0

Does this stop you from using Cursor

No - Cursor works, but with this issue

7

Thanks for the detailed repro! The trigger here isn’t sandbox detection - it’s the length of the socket path. macOS caps Unix socket paths at ~104 bytes, so when a long CURSOR_DATA_DIR pushes the derived path over that, the agent falls back to a short base (/tmp/.cursor), which is why the sandbox/TMPDIR toggles made no difference.

Workaround: keep CURSOR_DATA_DIR short (e.g. ~/.cd) and the socket stays under it, or add /tmp/.cursor to your sandbox’s writable paths.

Not intended behavior - we’ve let the team know, and I’ll post here when there’s an update.