Permissions.json allowlists disable Auto-review (with Sandbox) — contradicts docs

[haagendazs (Daniel Hanold)]

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Environment

• Cursor: 3.11.19 (macOS arm64)
• Run Mode UI: Settings → Agents → Approvals & Execution
• Config: ~/.cursor/permissions.json + ~/.cursor/sandbox.json

Summary

When ~/.cursor/permissions.json defines a non-empty terminalAllowlist and/or mcpAllowlist, Auto-review (with Sandbox) becomes non-selectable. Only Allowlist and Allowlist (with Sandbox) remain usable. Run Everything is correctly disabled (banner mentions this), but Auto-review is also locked out — which the banner does not mention.

This contradicts the public docs, which describe Auto-review as allowlist → sandbox → classifier and show terminalAllowlist + autoRun used together (permissions.json reference, Run Modes).

Expected

I should be able to select Auto-review (with Sandbox) so that:

1. allowlisted commands run immediately,
2. other eligible shell commands run in the sandbox,
3. the rest go to the classifier (steered by autoRun).

Actual

autoRun in the same file has no effect because Auto-review cannot be selected.

Notes / UX issues

• The banner only warns about Run Everything; it does not say Auto-review is also unavailable.
• Auto-review still appears in the list, which suggests it should be choosable.
• Hover/tooltip can imply admin disablement even when the only cause is a local permissions.json (no team admin policy).

What we tried

Setting undocumented "approvalMode": "unrestricted" (parsed by the client but not in the public field table) broke the Run Mode control entirely (no options shown). Removing that key restored Allowlist / Allowlist (with Sandbox), with Auto-review still locked. Do not recommend this as a workaround.

Why this matters

Projects that want a checked-in / copy-pasteable allowlist (stable command surface) cannot use the documented Auto-review composition. They are forced into pure Allowlist modes, so autoRun classifier steering is dead while the file owns the allowlist.

Ask

Please either:

1. Fix: allow Auto-review when permissions.json defines allowlists (allowlist as tier 1, as docs describe), and update the banner to match; or
2. Document: if this lock is intentional, state clearly that a non-empty file allowlist forces Allowlist-only modes and that autoRun only applies when allowlists are IDE-managed (not in the file).

Steps to Reproduce

1. Create ~/.cursor/permissions.json with a non-empty terminalAllowlist (and/or mcpAllowlist).
2. Open Settings → Agents → Approvals & Execution.
3. Banner appears: allowlists are set by the file; Run Everything is disabled while the file defines allowlists.
4. Open the Run Mode dropdown:
   • Allowlist — selectable
   • Allowlist (with Sandbox) — selectable
   • Auto-review (with Sandbox) — visible but not selectable
   • Run Everything (Unsandboxed) — disabled (as documented by the banner)

autoRun in the same file has no effect because Auto-review cannot be selected.

Expected Behavior

With a file like:

{
  "terminalAllowlist": ["git", "ls"],
  "autoRun": {
    "allow_instructions": ["Read-only git commands are fine."],
    "block_instructions": ["Never auto-approve rm -rf."]
  }
}

I should be able to select Auto-review (with Sandbox) so that:

1. allowlisted commands run immediately,
2. other eligible shell commands run in the sandbox,
3. the rest go to the classifier (steered by autoRun).

Screenshots / Screen Recordings

Operating System

MacOS

Version Information

Version: 3.11.19
VS Code Extension API: 1.125.0
Commit: bf249e6efb5b097f23d7e21d7283429f0760b740
Date: 2026-07-12T21:39:24.175Z
Layout: IDE
Build Type: Stable
Release Track: Default
Electron: 40.10.3
Chromium: 144.0.7559.236
Node.js: 24.15.0
V8: 14.4.258.32-electron.0
xterm.js: 6.1.0-beta.256
OS: Darwin arm64 25.5.0

For AI issues: which model did you use?

Grok 4.5 High

Does this stop you from using Cursor

Sometimes - I can sometimes use Cursor

[mohitjain (Mohit)]

Hey there,

I can reproduce it: a non-empty terminalAllowlist/mcpAllowlist in ~/.cursor/permissions.json locks out Auto-review (with Sandbox), not just Run Everything, and the banner only calls out Run Everything. That’s on us, and it contradicts the permissions.json reference and Run Modes, which describe terminalAllowlist and autoRun coexisting under Auto-review. I’ve reported it to the team, including the misleading tooltip.

Workaround to keep Auto-review plus classifier steering today: leave your autoRun instructions in permissions.json, but move terminalAllowlist/mcpAllowlist into Settings → Agents → Approvals & Execution. Auto-review stays selectable and your autoRun steering still applies. The catch is the literal allowlist array can’t be checked in that way, which is exactly the piece a fix should restore.

And yes, avoid approvalMode: "unrestricted"- it isn’t a supported field and breaks the Run Mode control.