Sandboxed `pnpm install` creates noisy `.pnpm-store/` inside project

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

When Cursor runs a pnpm install, my project directory is littered with uncommitted changes inside .pnpm-store/.

Cause

Agent sandbox shells set PNPM_STORE_PATH to $TMPDIR/cursor-sandbox-cache/<id>/pnpm-store, similarly to how it set overrides for other tools (NPM_CONFIG_CACHE, YARN_CACHE_FOLDER, UV_CACHE_DIR, etc.). However, this is not a real pnpm configuration variable. Sandboxed pnpm install therefore ignores the sandbox cache and tries to keep using the default store (on macOS, ~/Library/pnpm/store). However, the sandbox doesn’t allow writes there, and pnpm starts automatically looking for a fallback. It starts walking up from / towards the project, and puts .pnpm-store in the first directory which it can link to. Inside a Cursor sandbox that is the project directory.

Steps to Reproduce

  1. Open a pnpm project in Cursor Agent.
  2. Ask the agent to run this in a sandboxed shell:
    printenv PNPM_STORE_PATH
pnpm config get store-dir
pnpm store path
  3. Observe that PNPM_STORE_PATH is set to cursor-sandbox-cache/.../pnpm-store, but pnpm store path still reports the default store.

Expected Behavior

Cursor should set either PNPM_HOME or pnpm_config_store_dir in the sandbox instead. The latter is technically safer (affects only the store specifically), but the former is the far more idiomatic way of setting this path – the store then lives at $PNPM_HOME/store.

Also, if pnpm_config_store_dir is used, the path would have to be duplicated into npm_config_store_dir for pnpm v10 and earlier.

See more:

Operating System

MacOS

Version Information

Version: 3.15.19
VS Code Extension API: 1.128.0
Commit: de07bee81cefe43461ebf4f40c3d2d78d15052a0
Date: 2026-08-11T05:22:54.627Z
Layout: Agent Window
Build Type: Stable
Release Track: Default
Electron: 40.10.3
Chromium: 144.0.7559.236
Node.js: 24.15.0
V8: 14.4.258.32-electron.0
xterm.js: 6.1.0-beta.291
OS: Darwin arm64 25.6.0

Does this stop you from using Cursor

No - Cursor works, but with this issue

5

Hey, thanks for the detailed report. Your breakdown is spot on, and the root cause around PNPM_STORE_PATH is exactly right. I’ve shared it with the team along with your repro steps and the suggested fix. I can’t give a timeline yet, but I’ll reply in the thread when there’s an update.

As a workaround to reduce git noise, add .pnpm-store/ to .gitignore. You can also pin the store location outside the project via store-dir in .npmrc or PNPM_HOME, so pnpm won’t fall back to creating it inside the workspace.

Let me know if any of this doesn’t help.