Hey there! Thanks for reporting this.
This is a known limitation with how /worktree works in the editor sidepanel right now. The slash command delegates worktree creation to the agent’s shell, which means the bash script goes through the normal sandbox approval flow. Since the script writes to ~/.cursor/worktrees/ (outside your workspace) and generates a unique worktree ID each time, it can’t be pattern-matched for your allowlist.
@deanrie addressed this in a related thread — the team is actively working on moving the worktree lifecycle to the app side (like the old Cursor 2 UI worked), which would eliminate these prompts entirely.
In the meantime, the new Agent Window already handles worktree creation natively without going through the agent shell, so if you haven’t tried it yet, that’s worth a shot — you’d get the prompt-free experience there. You can also upvote this feature request for visibility.